@node9/proxy 2.48.2 → 2.50.0

package/dist/hook.js

@@ -456,6 +456,9 @@ function levelChecks(mode) {
 function levelPackageSignals(mode) {
   return levelOf(mode) === "soft" ? { newPackage: "off", installScript: "off" } : void 0;
 }
+function packRowOwasp(id, shield) {
+  return PACK_RULE_OWASP[id] ?? PACK_SHIELD_OWASP[shield];
+}
 function isVerdict(v) {
   return v === "off" || v === "log" || v === "review" || v === "block";
 }
@@ -475,6 +478,10 @@ function packRows() {
       rows.push({
         id,
         group: "commands",
+        // A shield missing from the table falls back to tool misuse instead of
+        // throwing here: this module loads on every hook call, and a mapping
+        // omission must fail a test (owasp.spec.ts), never the gate.
+        owasp: packRowOwasp(id, shield.name) ?? "ASI02",
         title: rule.name.replace(SHIELD_RULE_NAME, "$3").replace(/-/g, " "),
         catches: rule.description ?? rule.reason ?? "",
         values: ALL,
@@ -9561,7 +9568,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var import_url, import_picomatch, import_safe_regex2, import_picomatch2, import_module, import_picomatch3, import_safe_regex22, import_crypto, import_crypto2, import_crypto3, import_crypto4, getFilename, __filename2, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_ALTERNATIVES, MAX_CALL_DEPTH, MAX_CALL_WALKS, MAX_XARGS_PAYLOAD, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, ops, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, andOrOps, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, INDIRECT_SHAPE_RE, SOURCES_FILE_RE, SHELL_SET_VARS, pipeOps, callWords, JAILED_GLOB_NAMES, JAILED_DIR_NAMES, shellGlob, GLOB_META, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, BATCH_SEPARATOR, ENCODED_RUN_RE, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, CONTROL_CHAR_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var import_url, import_picomatch, import_safe_regex2, import_picomatch2, import_module, import_picomatch3, import_safe_regex22, import_crypto, import_crypto2, import_crypto3, import_crypto4, getFilename, __filename2, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, ASI, ASI_IDS, PACK_SHIELD_OWASP, PACK_RULE_OWASP, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_ALTERNATIVES, MAX_CALL_DEPTH, MAX_CALL_WALKS, MAX_XARGS_PAYLOAD, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, ops, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, andOrOps, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, INDIRECT_SHAPE_RE, SOURCES_FILE_RE, SHELL_SET_VARS, pipeOps, callWords, JAILED_GLOB_NAMES, JAILED_DIR_NAMES, shellGlob, GLOB_META, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, BATCH_SEPARATOR, ENCODED_RUN_RE, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, CONTROL_CHAR_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -11662,6 +11669,44 @@ var init_dist = __esm({
       strict: STRICT,
       "block-all": BLOCK_ALL
     };
+    ASI = {
+      ASI01: "Agent Goal Hijack",
+      ASI02: "Tool Misuse and Exploitation",
+      ASI03: "Identity and Privilege Abuse",
+      ASI04: "Agentic Supply Chain Vulnerabilities",
+      ASI05: "Unexpected Code Execution",
+      ASI06: "Memory and Context Poisoning",
+      ASI07: "Insecure Inter-Agent Communication",
+      ASI08: "Cascading Failures",
+      ASI09: "Human-Agent Trust Exploitation",
+      ASI10: "Rogue Agents"
+    };
+    ASI_IDS = Object.keys(ASI);
+    PACK_SHIELD_OWASP = {
+      aws: "ASI02",
+      "bash-safe": "ASI02",
+      docker: "ASI02",
+      filesystem: "ASI02",
+      github: "ASI02",
+      k8s: "ASI02",
+      mongodb: "ASI02",
+      postgres: "ASI02",
+      redis: "ASI02",
+      stripe: "ASI09",
+      paypal: "ASI09",
+      square: "ASI09",
+      plaid: "ASI09",
+      okta: "ASI09",
+      auth0: "ASI09"
+    };
+    PACK_RULE_OWASP = {
+      "packs.bash-safe.pipe-to-shell": "ASI05",
+      "packs.bash-safe.obfuscated-exec": "ASI05",
+      "packs.bash-safe.eval-remote": "ASI05",
+      "packs.bash-safe.eval-dynamic": "ASI05",
+      "packs.aws.iam-changes": "ASI03",
+      "packs.postgres.grant-revoke": "ASI03"
+    };
     VERDICTS = ["off", "log", "review", "block"];
     CHECK_VERDICT_RANK = { off: 0, log: 1, review: 2, block: 3 };
     ALL = VERDICTS;
@@ -11670,6 +11715,7 @@ var init_dist = __esm({
       {
         id: "files.shell-startup",
         group: "files",
+        owasp: "ASI02",
         title: "Shell startup files",
         catches: "Writes, replacements and removals of personal shell startup files",
         values: ALL,
@@ -11679,6 +11725,7 @@ var init_dist = __esm({
       {
         id: "files.system-auth",
         group: "files",
+        owasp: "ASI03",
         title: "System authentication files",
         catches: "Changes to system authentication files and PAM configuration",
         values: ["block"],
@@ -11689,6 +11736,7 @@ var init_dist = __esm({
       {
         id: "files.password-hashes",
         group: "files",
+        owasp: "ASI03",
         title: "System password hashes",
         catches: "Reads and copies of /etc/shadow and /etc/gshadow",
         values: ALL,
@@ -11698,6 +11746,7 @@ var init_dist = __esm({
       {
         id: "files.system-dirs",
         group: "files",
+        owasp: "ASI02",
         title: "System directories",
         catches: "Writes, new files and removals under /usr, /etc, /boot, /bin, /sbin, /lib and /var/log, and uploads of system files",
         values: ALL,
@@ -11707,6 +11756,7 @@ var init_dist = __esm({
       {
         id: "files.agent-instructions",
         group: "files",
+        owasp: "ASI06",
         title: "Agent instruction and memory files",
         catches: "writes to the files every later agent session loads as instructions (CLAUDE.md, AGENTS.md, memory, agents, commands) and changes to the agent's hooks; Standard asks only when the text carries an instruction to hide, skip approvals or touch secrets",
         values: ALL,
@@ -11717,6 +11767,7 @@ var init_dist = __esm({
       {
         id: "commands.inline-exec",
         group: "commands",
+        owasp: "ASI05",
         title: "Inline code execution",
         catches: "inline code (python -c, node -e, a heredoc into an interpreter) that deletes, sends, opens a socket, runs commands, reads protected files or decodes and runs; unreadable inline code",
         values: ALL,
@@ -11726,6 +11777,7 @@ var init_dist = __esm({
       {
         id: "commands.eval-dynamic",
         group: "commands",
+        owasp: "ASI05",
         title: "Eval of dynamic content",
         catches: "generated executable names, shell code from stdin, or dynamic eval/-c payloads",
         values: ALL,
@@ -11735,6 +11787,7 @@ var init_dist = __esm({
       {
         id: "commands.eval-remote",
         group: "commands",
+        owasp: "ASI05",
         title: "Eval of a remote download",
         catches: "eval or sh over the output of curl or wget",
         values: ["block"],
@@ -11745,6 +11798,7 @@ var init_dist = __esm({
       {
         id: "commands.curl-pipe-shell",
         group: "commands",
+        owasp: "ASI05",
         title: "Remote script piped into a shell",
         catches: "curl or wget piped into sh, bash, zsh or PowerShell",
         values: ALL,
@@ -11754,6 +11808,7 @@ var init_dist = __esm({
       {
         id: "commands.rm",
         group: "commands",
+        owasp: "ASI02",
         title: "Delete files",
         catches: "rm outside the known build-artifact paths",
         values: ALL,
@@ -11763,6 +11818,7 @@ var init_dist = __esm({
       {
         id: "commands.rm-home",
         group: "commands",
+        owasp: "ASI02",
         title: "Recursive delete of the home directory",
         catches: "rm -rf on ~, $HOME, /home or /",
         values: ["block"],
@@ -11773,6 +11829,7 @@ var init_dist = __esm({
       {
         id: "commands.chmod",
         group: "commands",
+        owasp: "ASI02",
         title: "World-writable permissions",
         catches: "chmod 777, 0777 or a+rwx",
         values: ALL,
@@ -11782,6 +11839,7 @@ var init_dist = __esm({
       {
         id: "commands.sudo",
         group: "commands",
+        owasp: "ASI03",
         title: "Elevated privileges",
         catches: "a command run through sudo",
         values: ALL,
@@ -11791,6 +11849,7 @@ var init_dist = __esm({
       {
         id: "commands.git-destructive",
         group: "commands",
+        owasp: "ASI02",
         title: "Destructive git operation",
         catches: "force push, reset --hard, clean -f, branch -D or tag delete, also through -C, env, wrappers, variables and aliases",
         values: ALL,
@@ -11800,6 +11859,7 @@ var init_dist = __esm({
       {
         id: "commands.git-hooks-bypass",
         group: "commands",
+        owasp: "ASI10",
         title: "Git hooks bypassed",
         catches: "the agent switches off the git hooks that check its own work: --no-verify, core.hooksPath, HUSKY=0 and its peers, or a hook file removed, emptied or made non-executable",
         values: ALL,
@@ -11809,6 +11869,7 @@ var init_dist = __esm({
       {
         id: "commands.git-stage-all",
         group: "commands",
+        owasp: "ASI02",
         title: "Stage everything at once",
         catches: "git add -A, git add ., git commit -a and other ways to stage every change instead of naming the files; off unless you switch it on",
         values: ALL,
@@ -11818,6 +11879,7 @@ var init_dist = __esm({
       {
         id: "commands.reverse-shell",
         group: "commands",
+        owasp: "ASI05",
         title: "Reverse shell",
         catches: "a shell wired to a network socket: bash -i >& /dev/tcp/\u2026, nc -e, socat exec:, a socket fd read by a shell, a shell piped to and from nc or telnet",
         values: ALL,
@@ -11827,6 +11889,7 @@ var init_dist = __esm({
       {
         id: "commands.node9-disarm",
         group: "commands",
+        owasp: "ASI10",
         title: "node9 disarmed from the shell",
         catches: "a node9 command that clears a session flag, trusts a destination, pauses the gate or weakens a shield, run by the agent",
         values: ALL,
@@ -11836,6 +11899,7 @@ var init_dist = __esm({
       {
         id: "commands.sql-ddl",
         group: "commands",
+        owasp: "ASI02",
         title: "Drop or truncate",
         catches: "DROP or TRUNCATE through a database CLI or a database tool",
         values: ALL,
@@ -11850,6 +11914,7 @@ var init_dist = __esm({
       {
         id: "commands.sql-no-where",
         group: "commands",
+        owasp: "ASI02",
         title: "Unscoped SQL mutation",
         catches: "DELETE or UPDATE without a WHERE clause",
         values: ALL,
@@ -11859,6 +11924,7 @@ var init_dist = __esm({
       {
         id: "commands.temp-binary",
         group: "commands",
+        owasp: "ASI05",
         title: "Binary from a temp directory",
         catches: "an absolute path under /tmp, /var/tmp, /dev/shm or a world-writable file",
         values: ALL,
@@ -11868,6 +11934,7 @@ var init_dist = __esm({
       {
         id: "commands.disk-destroy",
         group: "commands",
+        owasp: "ASI02",
         title: "Disk or filesystem destruction",
         catches: "mkfs, shred, dd and the manual-terminal disaster list",
         values: ALL,
@@ -11877,6 +11944,7 @@ var init_dist = __esm({
       {
         id: "commands.dangerous-word",
         group: "commands",
+        owasp: "ASI02",
         title: "Dangerous word",
         catches: "a word from a pack or from the config dangerousWords list",
         values: ALL,
@@ -11885,6 +11953,7 @@ var init_dist = __esm({
       {
         id: "commands.unanalysable",
         group: "commands",
+        owasp: "ASI02",
         title: "Command too nested to analyse",
         catches: "wrappers nested past the depth the shell parser follows",
         values: ALL,
@@ -11894,6 +11963,7 @@ var init_dist = __esm({
       {
         id: "commands.unknown",
         group: "commands",
+        owasp: "ASI02",
         title: "Any command no check recognised",
         catches: "the strict-mode catch-all",
         values: ["off", "review"],
@@ -11904,6 +11974,7 @@ var init_dist = __esm({
       {
         id: "data.secrets",
         group: "data",
+        owasp: "ASI03",
         title: "Secret in arguments",
         catches: "an API key, token or private key matching one of the DLP patterns",
         values: ALL,
@@ -11913,6 +11984,7 @@ var init_dist = __esm({
       {
         id: "data.secrets-weak",
         group: "data",
+        owasp: "ASI03",
         title: "Weak credential in arguments",
         catches: "a JWT or a bearer token",
         values: ALL,
@@ -11922,6 +11994,7 @@ var init_dist = __esm({
       {
         id: "data.pii",
         group: "data",
+        owasp: "ASI02",
         title: "Personal data in arguments",
         catches: "a social security number or a credit card number",
         values: ALL,
@@ -11931,6 +12004,7 @@ var init_dist = __esm({
       {
         id: "data.credential-files",
         group: "data",
+        owasp: "ASI03",
         title: "Credential file read",
         catches: "~/.ssh, ~/.aws and .env files, through any reader or any file tool",
         values: ALL,
@@ -11939,6 +12013,7 @@ var init_dist = __esm({
       {
         id: "data.credential-files-other",
         group: "data",
+        owasp: "ASI03",
         title: "Other credential file",
         catches: ".netrc, .npmrc, kube and docker config, and a copy of any credential file",
         values: ALL,
@@ -11947,6 +12022,7 @@ var init_dist = __esm({
       {
         id: "data.credential-files-unknown",
         group: "data",
+        owasp: "ASI03",
         title: "Files read by names known only at run time",
         catches: "a reader fed names from a listing that can include credential files (find . | xargs cat)",
         values: ALL,
@@ -11955,6 +12031,7 @@ var init_dist = __esm({
       {
         id: "data.pipe-chain",
         group: "data",
+        owasp: "ASI03",
         title: "Sensitive file piped to the network",
         catches: "a credential file read and piped into curl, nc or ssh",
         values: ALL,
@@ -11964,6 +12041,7 @@ var init_dist = __esm({
       {
         id: "data.pipe-chain-obfuscated",
         group: "data",
+        owasp: "ASI03",
         title: "Obfuscated exfiltration",
         catches: "a sensitive file encoded or compressed on its way to the network",
         values: ALL,
@@ -11976,6 +12054,7 @@ var init_dist = __esm({
       {
         id: "data.env-exfil",
         group: "data",
+        owasp: "ASI03",
         title: "Environment sent out",
         catches: "the whole environment (env, printenv, set, export -p, /proc/*/environ) handed to curl, nc or another sender, through $(\u2026), a pipe or a variable",
         values: ALL,
@@ -11985,6 +12064,7 @@ var init_dist = __esm({
       {
         id: "data.output-secrets",
         group: "data",
+        owasp: "ASI03",
         title: "Secret in tool output",
         catches: "a credential a tool returned; the session is tainted, nothing is stopped",
         values: ["off", "log"],
@@ -11993,6 +12073,7 @@ var init_dist = __esm({
       {
         id: "data.prompt-secrets",
         group: "data",
+        owasp: "ASI03",
         title: "Secret in the prompt",
         catches: "a credential pasted into the conversation",
         values: ALL,
@@ -12001,6 +12082,7 @@ var init_dist = __esm({
       {
         id: "data.canary",
         group: "data",
+        owasp: "ASI03",
         title: "Decoy credential used",
         catches: "a planted decoy value appears in a tool call",
         values: ALL,
@@ -12011,6 +12093,7 @@ var init_dist = __esm({
       {
         id: "network.unknown-host",
         group: "network",
+        owasp: "ASI02",
         title: "Unknown host",
         catches: "a destination on neither the allowlist nor the builtin list",
         values: ["off", "review", "block"],
@@ -12020,6 +12103,7 @@ var init_dist = __esm({
       {
         id: "network.internal-addresses",
         group: "network",
+        owasp: "ASI02",
         title: "Internal address",
         catches: "loopback, the RFC 1918 ranges and carrier-grade NAT",
         values: ["off", "block"],
@@ -12028,6 +12112,7 @@ var init_dist = __esm({
       {
         id: "network.metadata",
         group: "network",
+        owasp: "ASI02",
         title: "Cloud metadata address",
         catches: "169.254.169.254 and its peers, link-local and multicast",
         values: ["block"],
@@ -12038,6 +12123,7 @@ var init_dist = __esm({
       {
         id: "network.taint-egress",
         group: "network",
+        owasp: "ASI01",
         title: "Tainted data sent out",
         catches: "a file or an output flagged earlier in the session reaches a host not on the allowlist",
         values: ALL,
@@ -12051,6 +12137,7 @@ var init_dist = __esm({
       {
         id: "files.jail",
         group: "files",
+        owasp: "ASI03",
         title: "Jailed path",
         catches: "a path the workspace or the developer added to the jail",
         values: ALL,
@@ -12060,6 +12147,7 @@ var init_dist = __esm({
       {
         id: "behavior.loops",
         group: "behavior",
+        owasp: "ASI08",
         title: "Runaway loop",
         catches: "the same tool call repeated past the threshold inside the window",
         values: ["off", "block"],
@@ -12069,6 +12157,7 @@ var init_dist = __esm({
       {
         id: "behavior.prompt-injection",
         group: "behavior",
+        owasp: "ASI01",
         title: "Prompt injection in tool output",
         catches: "instructions aimed at the model inside content a tool returned",
         values: ["off", "log"],
@@ -12077,6 +12166,7 @@ var init_dist = __esm({
       {
         id: "behavior.session-taint",
         group: "behavior",
+        owasp: "ASI01",
         title: "Action after tainted output",
         catches: "a network call or a write after a flagged file or a flagged tool output",
         values: ALL,
@@ -12086,6 +12176,7 @@ var init_dist = __esm({
       {
         id: "behavior.untrusted-content",
         group: "behavior",
+        owasp: "ASI01",
         title: "Send after reading outside content",
         catches: "a send to an unknown destination, a destination found in what was read, or a destructive call after the session read an email, a web page or an issue",
         values: ["off", "log", "review"],
@@ -12096,6 +12187,7 @@ var init_dist = __esm({
       {
         id: "loading.skill-tamper",
         group: "loading",
+        owasp: "ASI04",
         title: "Skill file changed",
         catches: "a skill or plugin file whose hash differs from the one approved",
         values: ["off", "log", "block"],
@@ -12105,6 +12197,7 @@ var init_dist = __esm({
       {
         id: "loading.mcp-tamper",
         group: "loading",
+        owasp: "ASI04",
         title: "MCP server changed",
         catches: "tool definitions that differ from the pinned ones",
         values: ALL,
@@ -12114,6 +12207,7 @@ var init_dist = __esm({
       {
         id: "loading.malicious-package",
         group: "loading",
+        owasp: "ASI04",
         title: "Malicious package",
         catches: "an install of a package the index flags",
         values: ALL,
@@ -12123,6 +12217,7 @@ var init_dist = __esm({
       {
         id: "loading.unknown-registry",
         group: "loading",
+        owasp: "ASI04",
         title: "Package from an unknown registry",
         catches: "an install that names a registry on the command line (--registry, --index-url, -i, npm_config_registry=\u2026) that is not the public one, not in your npm, yarn, bun, pip or uv config and not on the allowlist",
         values: ALL,
@@ -12137,6 +12232,7 @@ var init_dist = __esm({
       {
         id: "actions.money",
         group: "actions",
+        owasp: "ASI09",
         title: "Money moves",
         catches: "a refund, payout, transfer, charge or withdrawal through an app with no protection of its own",
         values: ALL,
@@ -12149,6 +12245,7 @@ var init_dist = __esm({
       {
         id: "actions.access",
         group: "actions",
+        owasp: "ASI09",
         title: "Accounts and access change",
         catches: "a password, key, role, permission or user changed through an app with no protection of its own",
         values: ALL,
@@ -12158,6 +12255,7 @@ var init_dist = __esm({
       {
         id: "actions.publish",
         group: "actions",
+        owasp: "ASI09",
         title: "Something is published",
         catches: "a release, package, deploy or public post through an app with no protection of its own",
         values: ALL,
@@ -12170,6 +12268,7 @@ var init_dist = __esm({
       {
         id: "actions.settings",
         group: "actions",
+        owasp: "ASI09",
         title: "Repository, account and mailbox settings change",
         catches: "a repository made public, a deploy key, webhook or CI secret added, branch protection changed, mail forwarded outside or a public share link, through an app",
         values: ALL,
@@ -12179,6 +12278,7 @@ var init_dist = __esm({
       {
         id: "actions.protected-branch",
         group: "actions",
+        owasp: "ASI09",
         title: "The main branch changes through an app",
         catches: "a merge, a commit straight to main or master, or a CI workflow file written through an app",
         values: ALL,
@@ -18997,16 +19097,16 @@ var init_audit = __esm({
 // src/hook-entry.ts
 init_cjs_shims();
 var import_commander = require("commander");
-var import_fs37 = __toESM(require("fs"));
+var import_fs38 = __toESM(require("fs"));
 var import_os29 = __toESM(require("os"));
-var import_path39 = __toESM(require("path"));
+var import_path40 = __toESM(require("path"));
 
 // src/cli/commands/check.ts
 init_cjs_shims();
 var import_chalk2 = __toESM(require("chalk"));
-var import_fs35 = __toESM(require("fs"));
+var import_fs36 = __toESM(require("fs"));
 var import_child_process3 = require("child_process");
-var import_path37 = __toESM(require("path"));
+var import_path38 = __toESM(require("path"));
 var import_os27 = __toESM(require("os"));
 
 // src/auth/orchestrator.ts
@@ -19445,7 +19545,7 @@ function resolveLinkedServer(label2, opts = {}) {
 
 // src/auth/orchestrator.ts
 var import_os21 = __toESM(require("os"));
-var import_path30 = __toESM(require("path"));
+var import_path32 = __toESM(require("path"));
 
 // src/ui/native.ts
 init_cjs_shims();
@@ -20021,20 +20121,92 @@ function prepareFileAccesses(tool, args, cwd = process.cwd(), inspection = {}, h
 
 // src/auth/session-script.ts
 init_cjs_shims();
-var import_fs10 = __toESM(require("fs"));
+var import_fs12 = __toESM(require("fs"));
 var import_os9 = __toESM(require("os"));
-var import_path12 = __toESM(require("path"));
+var import_path14 = __toESM(require("path"));
 init_dist();
 
 // src/auth/daemon.ts
 init_cjs_shims();
-var import_fs9 = __toESM(require("fs"));
+var import_fs11 = __toESM(require("fs"));
 var import_http = __toESM(require("http"));
 var import_net = __toESM(require("net"));
-var import_path11 = __toESM(require("path"));
+var import_path13 = __toESM(require("path"));
 var import_os8 = __toESM(require("os"));
 init_forecast_context();
 
+// src/utils/activity-socket.ts
+init_cjs_shims();
+var import_fs10 = __toESM(require("fs"));
+var import_path12 = __toESM(require("path"));
+
+// src/utils/own-dir.ts
+init_cjs_shims();
+var import_fs9 = __toESM(require("fs"));
+var import_path11 = __toESM(require("path"));
+var SESSION_FLAG_SUFFIX = ".node9-flag";
+var SESSION_FLAG_NAME = /^[A-Za-z0-9_-]{1,128}\.node9-flag$/;
+function isSessionFlagName(name) {
+  return SESSION_FLAG_NAME.test(name);
+}
+function ownRealDir(st) {
+  if (st.isSymbolicLink() || !st.isDirectory()) return false;
+  return typeof process.getuid !== "function" || st.uid === process.getuid();
+}
+function ensureOwnDir(dir2) {
+  try {
+    import_fs9.default.mkdirSync(dir2, { recursive: true, mode: 448 });
+    const st = import_fs9.default.lstatSync(dir2);
+    return ownRealDir(st) ? { dev: st.dev, ino: st.ino } : null;
+  } catch {
+    return null;
+  }
+}
+function isSameOwnDir(dir2, seen) {
+  try {
+    const st = import_fs9.default.lstatSync(dir2);
+    return ownRealDir(st) && st.dev === seen.dev && st.ino === seen.ino;
+  } catch {
+    return false;
+  }
+}
+function removeOldFlag(dir2, seen, name, cutoffMs) {
+  if (!isSessionFlagName(name)) return;
+  const p = import_path11.default.join(dir2, name);
+  try {
+    const st = import_fs9.default.lstatSync(p);
+    if (!st.isFile() || st.mtimeMs >= cutoffMs) return;
+    if (!isSameOwnDir(dir2, seen)) return;
+    import_fs9.default.unlinkSync(p);
+  } catch {
+  }
+}
+
+// src/utils/activity-socket.ts
+var currentUid = () => typeof process.getuid === "function" ? process.getuid() : void 0;
+function isPrivateDir(dir2, uid = currentUid()) {
+  try {
+    const st = import_fs10.default.lstatSync(dir2);
+    if (st.isSymbolicLink() || !st.isDirectory()) return false;
+    if (uid !== void 0 && st.uid !== uid) return false;
+    return (st.mode & 18) === 0;
+  } catch {
+    return false;
+  }
+}
+var WINDOWS_PIPE = /^\\\\\.\\pipe\\node9-activity-[0-9a-f]{32}$/;
+function isTrustedActivitySocket(socketPath, uid = currentUid()) {
+  if (process.platform === "win32") return WINDOWS_PIPE.test(socketPath);
+  try {
+    const st = import_fs10.default.lstatSync(socketPath);
+    if (!st.isSocket()) return false;
+    if (uid !== void 0 && st.uid !== uid) return false;
+  } catch {
+    return false;
+  }
+  return isPrivateDir(import_path12.default.dirname(socketPath), uid);
+}
+
 // src/auth/decision-record.ts
 init_cjs_shims();
 var CHANNELS = ["terminal", "monitor", "native", "cloud"];
@@ -20184,10 +20356,20 @@ function recordFromLegacyWait(body, now = Date.now()) {
 }
 
 // src/auth/daemon.ts
-var ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : import_path11.default.join(import_os8.default.tmpdir(), "node9-activity.sock");
+function daemonActivitySocket(home = import_os8.default.homedir()) {
+  try {
+    const raw = import_fs11.default.readFileSync(import_path13.default.join(home, ".node9", "daemon.pid"), "utf-8");
+    const p = JSON.parse(raw).activitySocket;
+    return typeof p === "string" && isTrustedActivitySocket(p) ? p : null;
+  } catch {
+    return null;
+  }
+}
 var ACTIVITY_SOCKET_TIMEOUT_MS = 500;
 function notifyActivitySocket(data, opts = {}) {
   if (forecastRun()) return Promise.resolve(false);
+  const target = opts.socketPath ?? daemonActivitySocket();
+  if (!target) return Promise.resolve(false);
   return new Promise((resolve) => {
     let settled = false;
     let sock = null;
@@ -20201,7 +20383,7 @@ function notifyActivitySocket(data, opts = {}) {
     const timer = setTimeout(() => finish(false), opts.timeoutMs ?? ACTIVITY_SOCKET_TIMEOUT_MS);
     try {
       const payload = JSON.stringify(data);
-      sock = import_net.default.createConnection(opts.socketPath ?? ACTIVITY_SOCKET_PATH);
+      sock = import_net.default.createConnection(target);
       sock.on("connect", () => {
         sock.on("close", () => finish(true));
         sock.end(payload);
@@ -20240,9 +20422,9 @@ var DAEMON_HOST = "127.0.0.1";
 function getInternalToken() {
   if (forecastRun()) return null;
   try {
-    const pidFile = import_path11.default.join(import_os8.default.homedir(), ".node9", "daemon.pid");
-    if (!import_fs9.default.existsSync(pidFile)) return null;
-    const data = JSON.parse(import_fs9.default.readFileSync(pidFile, "utf-8"));
+    const pidFile = import_path13.default.join(import_os8.default.homedir(), ".node9", "daemon.pid");
+    if (!import_fs11.default.existsSync(pidFile)) return null;
+    const data = JSON.parse(import_fs11.default.readFileSync(pidFile, "utf-8"));
     process.kill(data.pid, 0);
     return data.internalToken ?? null;
   } catch {
@@ -20251,12 +20433,12 @@ function getInternalToken() {
 }
 function isDaemonRunning() {
   if (forecastRun()) return false;
-  const pidFile = import_path11.default.join(import_os8.default.homedir(), ".node9", "daemon.pid");
-  if (import_fs9.default.existsSync(pidFile)) {
+  const pidFile = import_path13.default.join(import_os8.default.homedir(), ".node9", "daemon.pid");
+  if (import_fs11.default.existsSync(pidFile)) {
     let pid;
     let port;
     try {
-      const data = JSON.parse(import_fs9.default.readFileSync(pidFile, "utf-8"));
+      const data = JSON.parse(import_fs11.default.readFileSync(pidFile, "utf-8"));
       pid = data.pid;
       port = data.port;
     } catch {
@@ -20274,7 +20456,7 @@ function isDaemonRunning() {
     } catch (err) {
       if (err instanceof Error && "code" in err && err.code === "ESRCH") {
         try {
-          import_fs9.default.unlinkSync(pidFile);
+          import_fs11.default.unlinkSync(pidFile);
         } catch {
         }
       }
@@ -20690,13 +20872,13 @@ var MAX_RECORDED_WRITES = 32;
 function readScriptFile(resolved) {
   let fd;
   try {
-    fd = import_fs10.default.openSync(resolved, import_fs10.default.constants.O_RDONLY | (import_fs10.default.constants.O_NONBLOCK ?? 0));
-    const st = import_fs10.default.fstatSync(fd);
+    fd = import_fs12.default.openSync(resolved, import_fs12.default.constants.O_RDONLY | (import_fs12.default.constants.O_NONBLOCK ?? 0));
+    const st = import_fs12.default.fstatSync(fd);
     if (!st.isFile() || st.size > MAX_SCRIPT_BYTES) return null;
     const buf = Buffer.alloc(MAX_SCRIPT_BYTES + 1);
     let n = 0;
     while (n < buf.length) {
-      const got = import_fs10.default.readSync(fd, buf, n, buf.length - n, n);
+      const got = import_fs12.default.readSync(fd, buf, n, buf.length - n, n);
       if (got === 0) break;
       n += got;
     }
@@ -20707,7 +20889,7 @@ function readScriptFile(resolved) {
   } finally {
     if (fd !== void 0) {
       try {
-        import_fs10.default.closeSync(fd);
+        import_fs12.default.closeSync(fd);
       } catch {
       }
     }
@@ -20715,7 +20897,7 @@ function readScriptFile(resolved) {
 }
 function absolute(p, cwd, home) {
   const spelled = p === "~" || p.startsWith("~/") ? home + p.slice(1) : p;
-  return import_path12.default.resolve(cwd, spelled);
+  return import_path14.default.resolve(cwd, spelled);
 }
 async function resolveSessionScript(toolName, args, cwd, layers, deps, home = import_os9.default.homedir()) {
   try {
@@ -20777,27 +20959,27 @@ init_dist();
 
 // src/exposure/known-hosts.ts
 init_cjs_shims();
-var import_fs12 = __toESM(require("fs"));
-var import_path14 = __toESM(require("path"));
+var import_fs14 = __toESM(require("fs"));
+var import_path16 = __toESM(require("path"));
 
 // src/utils/git-remotes.ts
 init_cjs_shims();
-var import_fs11 = __toESM(require("fs"));
-var import_path13 = __toESM(require("path"));
+var import_fs13 = __toESM(require("fs"));
+var import_path15 = __toESM(require("path"));
 init_dist();
 function readSmallFile(p, max) {
   let fd;
   try {
-    fd = import_fs11.default.openSync(p, import_fs11.default.constants.O_RDONLY | (import_fs11.default.constants.O_NOFOLLOW ?? 0));
-    const st = import_fs11.default.fstatSync(fd);
+    fd = import_fs13.default.openSync(p, import_fs13.default.constants.O_RDONLY | (import_fs13.default.constants.O_NOFOLLOW ?? 0));
+    const st = import_fs13.default.fstatSync(fd);
     if (!st.isFile() || st.size > max) return null;
     const buf = Buffer.alloc(st.size);
-    const n = import_fs11.default.readSync(fd, buf, 0, st.size, 0);
+    const n = import_fs13.default.readSync(fd, buf, 0, st.size, 0);
     return buf.subarray(0, n).toString("utf8");
   } catch {
     return null;
   } finally {
-    if (fd !== void 0) import_fs11.default.closeSync(fd);
+    if (fd !== void 0) import_fs13.default.closeSync(fd);
   }
 }
 function gitRemoteHost(url) {
@@ -20816,20 +20998,20 @@ function gitRemoteHost(url) {
   return null;
 }
 function findGitConfig(dir2, walkUp = true) {
-  let cur = import_path13.default.resolve(dir2);
+  let cur = import_path15.default.resolve(dir2);
   for (let i = 0; i < (walkUp ? 64 : 1); i++) {
-    const dotGit = import_path13.default.join(cur, ".git");
-    const direct = readSmallFile(import_path13.default.join(dotGit, "config"), 1e6);
+    const dotGit = import_path15.default.join(cur, ".git");
+    const direct = readSmallFile(import_path15.default.join(dotGit, "config"), 1e6);
     if (direct !== null) return direct;
     const pointer = readSmallFile(dotGit, 4096);
     const m = pointer && /^gitdir:\s*(.+?)\s*$/m.exec(pointer);
     if (m) {
-      let gitDir = import_path13.default.resolve(cur, m[1]);
-      const common = readSmallFile(import_path13.default.join(gitDir, "commondir"), 4096);
-      if (common !== null) gitDir = import_path13.default.resolve(gitDir, common.trim());
-      return readSmallFile(import_path13.default.join(gitDir, "config"), 1e6);
+      let gitDir = import_path15.default.resolve(cur, m[1]);
+      const common = readSmallFile(import_path15.default.join(gitDir, "commondir"), 4096);
+      if (common !== null) gitDir = import_path15.default.resolve(gitDir, common.trim());
+      return readSmallFile(import_path15.default.join(gitDir, "config"), 1e6);
     }
-    const parent = import_path13.default.dirname(cur);
+    const parent = import_path15.default.dirname(cur);
     if (parent === cur) return null;
     cur = parent;
   }
@@ -20839,12 +21021,12 @@ var cache3 = /* @__PURE__ */ new Map();
 function readGitRemotes(dir2, opts = {}) {
   if (!dir2) return [];
   const walkUp = opts.walkUp !== false;
-  const key = `${walkUp ? "up" : "at"}:${import_path13.default.resolve(dir2)}`;
+  const key = `${walkUp ? "up" : "at"}:${import_path15.default.resolve(dir2)}`;
   const hit = cache3.get(key);
   if (hit) return hit;
   const out = [];
   try {
-    const cfg = findGitConfig(import_path13.default.resolve(dir2), walkUp);
+    const cfg = findGitConfig(import_path15.default.resolve(dir2), walkUp);
     if (cfg !== null) {
       let current = null;
       for (const line of cfg.split(/\r?\n/)) {
@@ -20880,15 +21062,15 @@ var ECOSYSTEMS = [
 ];
 var cache4 = /* @__PURE__ */ new Map();
 function manifestRoot(dir2) {
-  let cur = import_path14.default.resolve(dir2);
+  let cur = import_path16.default.resolve(dir2);
   for (let i = 0; i < 64; i++) {
     for (const [m] of ECOSYSTEMS) {
       try {
-        if (import_fs12.default.existsSync(import_path14.default.join(cur, m))) return cur;
+        if (import_fs14.default.existsSync(import_path16.default.join(cur, m))) return cur;
       } catch {
       }
     }
-    const parent = import_path14.default.dirname(cur);
+    const parent = import_path16.default.dirname(cur);
     if (parent === cur) return null;
     cur = parent;
   }
@@ -20897,7 +21079,7 @@ function manifestRoot(dir2) {
 function knownProjectHosts(dir2) {
   const empty = { hosts: /* @__PURE__ */ new Set(), repos: /* @__PURE__ */ new Set(), remotes: /* @__PURE__ */ new Map() };
   if (!dir2) return empty;
-  const key = import_path14.default.resolve(dir2);
+  const key = import_path16.default.resolve(dir2);
   const hit = cache4.get(key);
   if (hit) return hit;
   const out = { hosts: /* @__PURE__ */ new Set(), repos: /* @__PURE__ */ new Set(), remotes: /* @__PURE__ */ new Map() };
@@ -20910,10 +21092,10 @@ function knownProjectHosts(dir2) {
     const root = manifestRoot(key);
     if (root !== null) {
       for (const [m, registry] of ECOSYSTEMS) {
-        if (import_fs12.default.existsSync(import_path14.default.join(root, m))) out.hosts.add(registry);
+        if (import_fs14.default.existsSync(import_path16.default.join(root, m))) out.hosts.add(registry);
       }
       try {
-        if (import_fs12.default.readdirSync(root).some((f) => f.endsWith(".gemspec")))
+        if (import_fs14.default.readdirSync(root).some((f) => f.endsWith(".gemspec")))
           out.hosts.add("host:rubygems.org");
       } catch {
       }
@@ -20926,9 +21108,9 @@ function knownProjectHosts(dir2) {
 
 // src/exposure/writes.ts
 init_cjs_shims();
-var import_fs13 = __toESM(require("fs"));
+var import_fs15 = __toESM(require("fs"));
 var import_os10 = __toESM(require("os"));
-var import_path15 = __toESM(require("path"));
+var import_path17 = __toESM(require("path"));
 init_dist();
 var WRITE_OPS = /* @__PURE__ */ new Set(["write", "create", "remove"]);
 var LIFECYCLE_RE = /"(scripts|preinstall|install|postinstall|prepare|prepublish|prepublishOnly|prepack|postpack|publish|postpublish)"\s*:/;
@@ -20958,7 +21140,7 @@ function packageScriptsTouched(args, absPath, shellCommand) {
   if (typeof a.content === "string") {
     try {
       const next = JSON.parse(a.content);
-      const prev = JSON.parse(import_fs13.default.readFileSync(absPath, "utf8"));
+      const prev = JSON.parse(import_fs15.default.readFileSync(absPath, "utf8"));
       return JSON.stringify(next.scripts ?? null) !== JSON.stringify(prev.scripts ?? null);
     } catch {
       return LIFECYCLE_RE.test(a.content);
@@ -20979,7 +21161,7 @@ function judgeWritesAfterExposure(opts) {
     seen.add(p);
     if (p === "/dev" || p.startsWith("/dev/")) continue;
     if (root !== null && isInside(root, p)) {
-      if (isAgentInstructionPath(p, root) && (import_path15.default.basename(p) !== "package.json" || packageScriptsTouched(opts.args, p, opts.shellCommand)))
+      if (isAgentInstructionPath(p, root) && (import_path17.default.basename(p) !== "package.json" || packageScriptsTouched(opts.args, p, opts.shellCommand)))
         holds.push({ path: p, why: "agent-instruction" });
       continue;
     }
@@ -21002,9 +21184,9 @@ function judgeWritesAfterExposure(opts) {
 // src/exposure/marker.ts
 init_cjs_shims();
 var import_crypto7 = __toESM(require("crypto"));
-var import_fs14 = __toESM(require("fs"));
+var import_fs16 = __toESM(require("fs"));
 var import_os11 = __toESM(require("os"));
-var import_path16 = __toESM(require("path"));
+var import_path18 = __toESM(require("path"));
 
 // src/daemon/exposure-store.ts
 init_cjs_shims();
@@ -21013,30 +21195,30 @@ var SESSION_EXPOSURE_TTL_MS = 4 * 60 * 60 * 1e3;
 // src/exposure/marker.ts
 init_forecast_context();
 function dir() {
-  return import_path16.default.join(import_os11.default.homedir(), ".node9", "exposure-sessions");
+  return import_path18.default.join(import_os11.default.homedir(), ".node9", "exposure-sessions");
 }
 function file(sessionId) {
   const id = import_crypto7.default.createHash("sha256").update(sessionId).digest("hex").slice(0, 32);
-  return import_path16.default.join(dir(), id);
+  return import_path18.default.join(dir(), id);
 }
 function markSessionExposed(sessionId) {
   if (!sessionId) return;
   if (forecastRun()) return;
   try {
-    import_fs14.default.mkdirSync(dir(), { recursive: true, mode: 448 });
+    import_fs16.default.mkdirSync(dir(), { recursive: true, mode: 448 });
     const f = file(sessionId);
     const now = /* @__PURE__ */ new Date();
     try {
-      import_fs14.default.utimesSync(f, now, now);
+      import_fs16.default.utimesSync(f, now, now);
     } catch {
-      import_fs14.default.writeFileSync(f, "", { mode: 384 });
+      import_fs16.default.writeFileSync(f, "", { mode: 384 });
     }
     if (Math.random() < 0.05) {
       const cutoff = Date.now() - 24 * 60 * 60 * 1e3;
-      for (const name of import_fs14.default.readdirSync(dir())) {
+      for (const name of import_fs16.default.readdirSync(dir())) {
         try {
-          const p = import_path16.default.join(dir(), name);
-          if (import_fs14.default.statSync(p).mtimeMs < cutoff) import_fs14.default.unlinkSync(p);
+          const p = import_path18.default.join(dir(), name);
+          if (import_fs16.default.statSync(p).mtimeMs < cutoff) import_fs16.default.unlinkSync(p);
         } catch {
         }
       }
@@ -21049,7 +21231,7 @@ function maybeSessionExposed(sessionId) {
   const forecast = forecastRun();
   if (forecast) return forecast.session.checkExposure(forecast.now) !== null;
   try {
-    const st = import_fs14.default.statSync(file(sessionId));
+    const st = import_fs16.default.statSync(file(sessionId));
     return Date.now() - st.mtimeMs < SESSION_EXPOSURE_TTL_MS;
   } catch (e) {
     return e.code !== "ENOENT";
@@ -21058,7 +21240,7 @@ function maybeSessionExposed(sessionId) {
 
 // src/exposure/roles.ts
 init_cjs_shims();
-var import_fs15 = __toESM(require("fs"));
+var import_fs17 = __toESM(require("fs"));
 var EXPOSURE_LABEL = "\u{1F6E1}\uFE0F Node9 Exposure";
 var AGENT_INTERNAL_PREFIXES = ["ccd_", "visualize"];
 function foldServerName(name) {
@@ -21068,7 +21250,7 @@ var inventoryCache = null;
 var inventoryStamp = null;
 function inventoryFileStamp() {
   try {
-    const st = import_fs15.default.statSync(getMcpToolsFile());
+    const st = import_fs17.default.statSync(getMcpToolsFile());
     return `${st.mtimeMs}:${st.size}`;
   } catch {
     return "";
@@ -21165,16 +21347,16 @@ function sourceWord(toolName) {
 
 // src/auth/trusted-recipients.ts
 init_cjs_shims();
-var import_fs16 = __toESM(require("fs"));
-var import_path17 = __toESM(require("path"));
+var import_fs18 = __toESM(require("fs"));
+var import_path19 = __toESM(require("path"));
 var import_os12 = __toESM(require("os"));
 init_dist();
 function getTrustedRecipientsPath() {
-  return import_path17.default.join(import_os12.default.homedir(), ".node9", "trusted-recipients.json");
+  return import_path19.default.join(import_os12.default.homedir(), ".node9", "trusted-recipients.json");
 }
 function readTrustedRecipients() {
   try {
-    const raw = import_fs16.default.readFileSync(getTrustedRecipientsPath(), "utf8");
+    const raw = import_fs18.default.readFileSync(getTrustedRecipientsPath(), "utf8");
     const parsed = JSON.parse(raw);
     return Array.isArray(parsed.entries) ? parsed.entries.filter((e) => e && typeof e.value === "string") : [];
   } catch {
@@ -21183,10 +21365,10 @@ function readTrustedRecipients() {
 }
 function writeTrustedRecipients(entries) {
   const filePath = getTrustedRecipientsPath();
-  import_fs16.default.mkdirSync(import_path17.default.dirname(filePath), { recursive: true });
+  import_fs18.default.mkdirSync(import_path19.default.dirname(filePath), { recursive: true });
   const tmp = filePath + ".node9-tmp";
-  import_fs16.default.writeFileSync(tmp, JSON.stringify({ entries }, null, 2), { mode: 384 });
-  import_fs16.default.renameSync(tmp, filePath);
+  import_fs18.default.writeFileSync(tmp, JSON.stringify({ entries }, null, 2), { mode: 384 });
+  import_fs18.default.renameSync(tmp, filePath);
 }
 function addTrustedRecipient(raw, addedBy = "user") {
   const value = normalizeRecipient(raw);
@@ -21201,7 +21383,7 @@ function addTrustedRecipient(raw, addedBy = "user") {
 var cache5 = null;
 function mtimeOf() {
   try {
-    return import_fs16.default.statSync(getTrustedRecipientsPath()).mtimeMs;
+    return import_fs18.default.statSync(getTrustedRecipientsPath()).mtimeMs;
   } catch {
     return 0;
   }
@@ -21216,15 +21398,15 @@ function isTrustedRecipient(value) {
 
 // src/auth/trusted-hosts.ts
 init_cjs_shims();
-var import_fs17 = __toESM(require("fs"));
-var import_path18 = __toESM(require("path"));
+var import_fs19 = __toESM(require("fs"));
+var import_path20 = __toESM(require("path"));
 var import_os13 = __toESM(require("os"));
 function getTrustedHostsPath() {
-  return import_path18.default.join(import_os13.default.homedir(), ".node9", "trusted-hosts.json");
+  return import_path20.default.join(import_os13.default.homedir(), ".node9", "trusted-hosts.json");
 }
 function readTrustedHosts() {
   try {
-    const raw = import_fs17.default.readFileSync(getTrustedHostsPath(), "utf8");
+    const raw = import_fs19.default.readFileSync(getTrustedHostsPath(), "utf8");
     const parsed = JSON.parse(raw);
     return Array.isArray(parsed.hosts) ? parsed.hosts : [];
   } catch {
@@ -21235,7 +21417,7 @@ var _cache = null;
 var CACHE_TTL_MS = 5e3;
 function getFileMtime() {
   try {
-    return import_fs17.default.statSync(getTrustedHostsPath()).mtimeMs;
+    return import_fs19.default.statSync(getTrustedHostsPath()).mtimeMs;
   } catch {
     return 0;
   }
@@ -21273,8 +21455,8 @@ function isTrustedHost(host2) {
 
 // src/config/index.ts
 init_cjs_shims();
-var import_fs18 = __toESM(require("fs"));
-var import_path19 = __toESM(require("path"));
+var import_fs20 = __toESM(require("fs"));
+var import_path21 = __toESM(require("path"));
 var import_os14 = __toESM(require("os"));
 
 // src/config-schema.ts
@@ -21468,8 +21650,8 @@ var ConfigFileSchema = import_zod.z.object({
 }).strict();
 function formatIssues(issues) {
   const lines = issues.map((issue) => {
-    const path40 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
-    return `  \u2022 ${path40}: ${issue.message}`;
+    const path41 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
+    return `  \u2022 ${path41}: ${issue.message}`;
   });
   return `Invalid config:
 ${lines.join("\n")}`;
@@ -21482,9 +21664,9 @@ function prunePaths(root, paths) {
     const yi = y[y.length - 1];
     return typeof xi === "number" && typeof yi === "number" ? yi - xi : 0;
   });
-  for (const path40 of ordered) {
+  for (const path41 of ordered) {
     let cur = root;
-    for (const key of path40.slice(0, -1)) {
+    for (const key of path41.slice(0, -1)) {
       if (cur === null || typeof cur !== "object") {
         cur = void 0;
         break;
@@ -21492,7 +21674,7 @@ function prunePaths(root, paths) {
       cur = cur[key];
     }
     if (cur === null || typeof cur !== "object") continue;
-    const last = path40[path40.length - 1];
+    const last = path41[path41.length - 1];
     if (Array.isArray(cur)) {
       const i = Number(last);
       if (Number.isInteger(i) && i >= 0 && i < cur.length) {
@@ -21528,7 +21710,7 @@ function sanitizeConfig(raw) {
           return issue.keys.map((k) => [...at, k]);
         }
         return [at.slice(0, -level || void 0)];
-      }).filter((path40) => path40.length > 0);
+      }).filter((path41) => path41.length > 0);
       if (paths.length === 0 || !prunePaths(working, paths)) break;
     }
     if (ConfigFileSchema.safeParse(working).success) break;
@@ -22190,8 +22372,8 @@ function noteRejectedApiUrl(raw) {
   if (rejectedApiUrlsSeen.has(key)) return;
   rejectedApiUrlsSeen.add(key);
   try {
-    import_fs18.default.appendFileSync(
-      import_path19.default.join(import_os14.default.homedir(), ".node9", "hook-debug.log"),
+    import_fs20.default.appendFileSync(
+      import_path21.default.join(import_os14.default.homedir(), ".node9", "hook-debug.log"),
       `[${(/* @__PURE__ */ new Date()).toISOString()}] REFUSED apiUrl, using the default instead: ${String(raw).slice(0, 200).replace(/[\r\n]+/g, " ")}
 `
     );
@@ -22208,9 +22390,9 @@ function getCredentials() {
     };
   }
   try {
-    const credPath = import_path19.default.join(import_os14.default.homedir(), ".node9", "credentials.json");
-    if (import_fs18.default.existsSync(credPath)) {
-      const creds = JSON.parse(import_fs18.default.readFileSync(credPath, "utf-8"));
+    const credPath = import_path21.default.join(import_os14.default.homedir(), ".node9", "credentials.json");
+    if (import_fs20.default.existsSync(credPath)) {
+      const creds = JSON.parse(import_fs20.default.readFileSync(credPath, "utf-8"));
       const profileName = process.env.NODE9_PROFILE || "default";
       const profile = creds[profileName];
       if (typeof profile?.apiKey === "string" && profile.apiKey.length > 0) {
@@ -22242,7 +22424,7 @@ function readRulesCacheResilient(cacheFile) {
   for (let attempt = 0; attempt < 3; attempt++) {
     let content;
     try {
-      content = import_fs18.default.readFileSync(cacheFile, "utf-8");
+      content = import_fs20.default.readFileSync(cacheFile, "utf-8");
       existed = true;
     } catch (err) {
       if (err.code === "ENOENT") return {};
@@ -22257,10 +22439,10 @@ function readRulesCacheResilient(cacheFile) {
     }
   }
   if (existed || sawReadError) {
-    const backup = import_path19.default.join(import_path19.default.dirname(cacheFile), "rules-cache.last-good.json");
+    const backup = import_path21.default.join(import_path21.default.dirname(cacheFile), "rules-cache.last-good.json");
     if (backup !== cacheFile) {
       try {
-        const raw = JSON.parse(import_fs18.default.readFileSync(backup, "utf-8"));
+        const raw = JSON.parse(import_fs20.default.readFileSync(backup, "utf-8"));
         logCacheReadIssue(cacheFile, "RULES_CACHE_CORRUPT_USED_BACKUP");
         lastParsedRulesCache = raw;
         return raw;
@@ -22283,8 +22465,8 @@ function logCacheReadIssue(cacheFile, kind) {
   if (now - cacheReadLastLoggedAt < CACHE_LOG_REARM_MS) return;
   cacheReadLastLoggedAt = now;
   try {
-    import_fs18.default.appendFileSync(
-      import_path19.default.join(import_os14.default.homedir(), ".node9", "hook-debug.log"),
+    import_fs20.default.appendFileSync(
+      import_path21.default.join(import_os14.default.homedir(), ".node9", "hook-debug.log"),
       `[${(/* @__PURE__ */ new Date()).toISOString()}] ${kind} ${cacheFile}
 `
     );
@@ -22310,8 +22492,8 @@ function catalogSettingsFrom(settings, policy) {
 }
 function getConfig(cwd) {
   if (!cwd && cachedConfig) return cachedConfig;
-  const globalPath = import_path19.default.join(import_os14.default.homedir(), ".node9", "config.json");
-  const projectPath = import_path19.default.join(cwd ?? process.cwd(), "node9.config.json");
+  const globalPath = import_path21.default.join(import_os14.default.homedir(), ".node9", "config.json");
+  const projectPath = import_path21.default.join(cwd ?? process.cwd(), "node9.config.json");
   const globalConfig = tryLoadConfig(globalPath);
   const projectConfig = tryLoadConfig(projectPath, { project: true });
   const mergedSettings = {
@@ -22556,7 +22738,7 @@ function getConfig(cwd) {
   let cloudMandatesEnforcement = false;
   let cloudMandatesAppPerm = false;
   {
-    const cacheFile = import_path19.default.join(import_os14.default.homedir(), ".node9", "rules-cache.json");
+    const cacheFile = import_path21.default.join(import_os14.default.homedir(), ".node9", "rules-cache.json");
     try {
       const raw = readRulesCacheResilient(cacheFile);
       if (Array.isArray(raw.rules) && raw.rules.length > 0) {
@@ -22749,13 +22931,13 @@ function getConfig(cwd) {
         }
         if (Array.isArray(mc.jailPaths)) {
           for (const jp of mc.jailPaths) {
-            const path40 = typeof jp?.path === "string" ? jp.path.trim() : "";
-            if (!path40) continue;
+            const path41 = typeof jp?.path === "string" ? jp.path.trim() : "";
+            if (!path41) continue;
             const verdict = jp?.verdict === "review" ? "review" : "block";
-            for (const r of pathRules(path40, verdict, "org-managed jail")) {
+            for (const r of pathRules(path41, verdict, "org-managed jail")) {
               mergedPolicy.smartRules.push({ ...r, name: `org:${r.name}` });
             }
-            mergedPolicy.managedJailPaths.push({ path: path40, verdict });
+            mergedPolicy.managedJailPaths.push({ path: path41, verdict });
           }
         }
         if (Array.isArray(mc.trustedHosts)) {
@@ -22988,10 +23170,10 @@ function getConfig(cwd) {
 }
 function tryLoadConfig(filePath, options = {}) {
   v2ChecksByPath.delete(filePath);
-  if (!import_fs18.default.existsSync(filePath)) return null;
+  if (!import_fs20.default.existsSync(filePath)) return null;
   let raw;
   try {
-    raw = JSON.parse(import_fs18.default.readFileSync(filePath, "utf-8"));
+    raw = JSON.parse(import_fs20.default.readFileSync(filePath, "utf-8"));
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     process.stderr.write(
@@ -23096,27 +23278,27 @@ init_forecast_context();
 // src/policy/index.ts
 init_cjs_shims();
 init_dist();
-var import_fs25 = __toESM(require("fs"));
+var import_fs27 = __toESM(require("fs"));
 
 // src/utils/read-capped.ts
 init_cjs_shims();
-var import_fs19 = __toESM(require("fs"));
+var import_fs21 = __toESM(require("fs"));
 function readCapped(file2, maxBytes, openFlags = "r") {
   if (maxBytes < 0) return null;
   let fd;
   try {
-    fd = import_fs19.default.openSync(file2, openFlags);
+    fd = import_fs21.default.openSync(file2, openFlags);
   } catch {
     return null;
   }
   try {
-    const st = import_fs19.default.fstatSync(fd);
+    const st = import_fs21.default.fstatSync(fd);
     if (!st.isFile()) return null;
     const want = Math.min(st.size, maxBytes + 1);
     const buf = Buffer.alloc(want);
     let read3 = 0;
     while (read3 < want) {
-      const n = import_fs19.default.readSync(fd, buf, read3, want - read3, read3);
+      const n = import_fs21.default.readSync(fd, buf, read3, want - read3, read3);
       if (n <= 0) break;
       read3 += n;
     }
@@ -23128,7 +23310,7 @@ function readCapped(file2, maxBytes, openFlags = "r") {
     return null;
   } finally {
     try {
-      import_fs19.default.closeSync(fd);
+      import_fs21.default.closeSync(fd);
     } catch {
     }
   }
@@ -23139,7 +23321,7 @@ function readCappedText(file2, maxBytes, openFlags = "r") {
 }
 
 // src/policy/index.ts
-var import_path26 = __toESM(require("path"));
+var import_path28 = __toESM(require("path"));
 
 // src/policy/gate-order.ts
 init_cjs_shims();
@@ -23356,40 +23538,40 @@ function combineWithEngine(gates, engine, opts = { panicMode: false }) {
 // src/supply-chain/check.ts
 init_cjs_shims();
 var import_picomatch4 = __toESM(require("picomatch"));
-var import_path23 = __toESM(require("path"));
+var import_path25 = __toESM(require("path"));
 init_dist();
 
 // src/supply-chain/osv-index.ts
 init_cjs_shims();
-var import_fs21 = __toESM(require("fs"));
+var import_fs23 = __toESM(require("fs"));
 var import_os15 = __toESM(require("os"));
-var import_path21 = __toESM(require("path"));
+var import_path23 = __toESM(require("path"));
 var import_crypto9 = require("crypto");
 init_dist();
 
 // src/utils/atomic-write.ts
 init_cjs_shims();
-var import_fs20 = __toESM(require("fs"));
-var import_path20 = __toESM(require("path"));
+var import_fs22 = __toESM(require("fs"));
+var import_path22 = __toESM(require("path"));
 var import_crypto8 = require("crypto");
 function atomicWriteSync(filePath, data, options) {
-  const dir2 = import_path20.default.dirname(filePath);
-  if (!import_fs20.default.existsSync(dir2)) import_fs20.default.mkdirSync(dir2, { recursive: true });
+  const dir2 = import_path22.default.dirname(filePath);
+  if (!import_fs22.default.existsSync(dir2)) import_fs22.default.mkdirSync(dir2, { recursive: true });
   const tmpPath = `${filePath}.${(0, import_crypto8.randomUUID)()}.tmp`;
   try {
-    import_fs20.default.writeFileSync(tmpPath, data, options);
+    import_fs22.default.writeFileSync(tmpPath, data, options);
   } catch (err) {
     try {
-      import_fs20.default.unlinkSync(tmpPath);
+      import_fs22.default.unlinkSync(tmpPath);
     } catch {
     }
     throw err;
   }
   try {
-    import_fs20.default.renameSync(tmpPath, filePath);
+    import_fs22.default.renameSync(tmpPath, filePath);
   } catch (err) {
     try {
-      import_fs20.default.unlinkSync(tmpPath);
+      import_fs22.default.unlinkSync(tmpPath);
     } catch {
     }
     throw err;
@@ -23399,10 +23581,10 @@ function atomicWriteSync(filePath, data, options) {
 // src/supply-chain/osv-index.ts
 var INDEX_FRESH_MS = 72 * 60 * 60 * 1e3;
 function osvRoot() {
-  return import_path21.default.join(import_os15.default.homedir(), ".node9", "osv");
+  return import_path23.default.join(import_os15.default.homedir(), ".node9", "osv");
 }
 function ecoDir(eco) {
-  return import_path21.default.join(osvRoot(), eco);
+  return import_path23.default.join(osvRoot(), eco);
 }
 function indexKey(eco, name) {
   switch (eco) {
@@ -23421,11 +23603,11 @@ function shardOf(key) {
   return (0, import_crypto9.createHash)("sha1").update(key).digest("hex").slice(0, 2);
 }
 function shardPath(eco, shard) {
-  return import_path21.default.join(ecoDir(eco), "shards", `${shard}.json`);
+  return import_path23.default.join(ecoDir(eco), "shards", `${shard}.json`);
 }
 function readMeta(eco) {
   try {
-    const m = JSON.parse(import_fs21.default.readFileSync(import_path21.default.join(ecoDir(eco), "meta.json"), "utf8"));
+    const m = JSON.parse(import_fs23.default.readFileSync(import_path23.default.join(ecoDir(eco), "meta.json"), "utf8"));
     if (typeof m?.syncedAt !== "string" || typeof m?.lastModifiedMs !== "number") return null;
     return m;
   } catch {
@@ -23434,7 +23616,7 @@ function readMeta(eco) {
 }
 function readShard(eco, shard) {
   try {
-    const s = JSON.parse(import_fs21.default.readFileSync(shardPath(eco, shard), "utf8"));
+    const s = JSON.parse(import_fs23.default.readFileSync(shardPath(eco, shard), "utf8"));
     return s && typeof s === "object" && !Array.isArray(s) ? s : {};
   } catch {
     return {};
@@ -23788,19 +23970,19 @@ async function registryInfo(eco, name, version2, freshWindowMs, raw) {
 
 // src/supply-chain/local-resolve.ts
 init_cjs_shims();
-var import_fs22 = __toESM(require("fs"));
-var import_path22 = __toESM(require("path"));
+var import_fs24 = __toESM(require("fs"));
+var import_path24 = __toESM(require("path"));
 var MAX_LEVELS = 32;
 var LOCAL_FIRST_MANAGERS = /* @__PURE__ */ new Set(["npx", "bunx", "npm exec"]);
 function resolveInstalled(name, cwd) {
-  if (!cwd || !import_path22.default.isAbsolute(cwd)) return null;
+  if (!cwd || !import_path24.default.isAbsolute(cwd)) return null;
   if (!/^(?:@[^/\\]+\/)?[^/\\]+$/.test(name)) return null;
-  let dir2 = import_path22.default.resolve(cwd);
+  let dir2 = import_path24.default.resolve(cwd);
   for (let i = 0; i < MAX_LEVELS; i++) {
-    const pkgDir = import_path22.default.join(dir2, "node_modules", ...name.split("/"));
-    const manifest = import_path22.default.join(pkgDir, "package.json");
+    const pkgDir = import_path24.default.join(dir2, "node_modules", ...name.split("/"));
+    const manifest = import_path24.default.join(pkgDir, "package.json");
     try {
-      const raw = import_fs22.default.readFileSync(manifest, "utf8");
+      const raw = import_fs24.default.readFileSync(manifest, "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.version === "string" && parsed.version.length > 0) {
         return { version: parsed.version, dir: pkgDir };
@@ -23808,7 +23990,7 @@ function resolveInstalled(name, cwd) {
       return null;
     } catch {
     }
-    const parent = import_path22.default.dirname(dir2);
+    const parent = import_path24.default.dirname(dir2);
     if (parent === dir2) break;
     dir2 = parent;
   }
@@ -23930,7 +24112,7 @@ function checkInstalled(p, version2, misses) {
 }
 async function checkOne(p, cfg, misses, networkCapped, cwd) {
   if (p.ecosystem === "npm" && LOCAL_FIRST_MANAGERS.has(p.manager) && p.localCwd !== null && (p.raw === p.name || p.version)) {
-    const localCwd = cwd && import_path23.default.isAbsolute(cwd) ? (p.localCwd ?? []).reduce((dir2, step) => import_path23.default.resolve(dir2, step), cwd) : void 0;
+    const localCwd = cwd && import_path25.default.isAbsolute(cwd) ? (p.localCwd ?? []).reduce((dir2, step) => import_path25.default.resolve(dir2, step), cwd) : void 0;
     const installed = resolveInstalled(p.name, localCwd);
     if (installed && (!p.version || p.version === installed.version))
       return checkInstalled(p, installed.version, misses);
@@ -24076,8 +24258,8 @@ async function runPackageCheck(toolName, args, cfg, cwd, opts = {}) {
 // src/supply-chain/registries.ts
 init_cjs_shims();
 var import_os16 = __toESM(require("os"));
-var import_path24 = __toESM(require("path"));
-var import_fs23 = __toESM(require("fs"));
+var import_path26 = __toESM(require("path"));
+var import_fs25 = __toESM(require("fs"));
 init_dist();
 var MAX_CONFIG_BYTES = 256 * 1024;
 var MAX_PARENT_DIRS = 12;
@@ -24119,29 +24301,29 @@ var REGISTRY_KEY_RE = /registry|index|find-links|mirror/i;
 var REGISTRY_SECTION_RE = /index|source|registr|scopes|mirror/i;
 var URL_RE2 = /https?:\/\/[^\s"'<>,;]+/gi;
 function userFiles(home, env) {
-  const xdg = env.XDG_CONFIG_HOME || import_path24.default.join(home, ".config");
+  const xdg = env.XDG_CONFIG_HOME || import_path26.default.join(home, ".config");
   return [
-    env.NPM_CONFIG_USERCONFIG || env.npm_config_userconfig || import_path24.default.join(home, ".npmrc"),
-    import_path24.default.join(home, ".yarnrc"),
-    import_path24.default.join(home, ".yarnrc.yml"),
-    import_path24.default.join(home, ".bunfig.toml"),
+    env.NPM_CONFIG_USERCONFIG || env.npm_config_userconfig || import_path26.default.join(home, ".npmrc"),
+    import_path26.default.join(home, ".yarnrc"),
+    import_path26.default.join(home, ".yarnrc.yml"),
+    import_path26.default.join(home, ".bunfig.toml"),
     env.PIP_CONFIG_FILE || "",
-    import_path24.default.join(xdg, "pip", "pip.conf"),
-    import_path24.default.join(home, ".pip", "pip.conf"),
+    import_path26.default.join(xdg, "pip", "pip.conf"),
+    import_path26.default.join(home, ".pip", "pip.conf"),
     "/etc/pip.conf",
-    env.VIRTUAL_ENV ? import_path24.default.join(env.VIRTUAL_ENV, "pip.conf") : "",
+    env.VIRTUAL_ENV ? import_path26.default.join(env.VIRTUAL_ENV, "pip.conf") : "",
     env.UV_CONFIG_FILE || "",
-    import_path24.default.join(xdg, "uv", "uv.toml"),
+    import_path26.default.join(xdg, "uv", "uv.toml"),
     "/etc/uv/uv.toml"
   ].filter(Boolean);
 }
 function projectFiles(cwd) {
-  if (!cwd || !import_path24.default.isAbsolute(cwd)) return [];
+  if (!cwd || !import_path26.default.isAbsolute(cwd)) return [];
   const out = [];
   let dir2 = cwd;
   for (let i = 0; i < MAX_PARENT_DIRS; i++) {
-    for (const f of PROJECT_FILES) out.push(import_path24.default.join(dir2, f));
-    const parent = import_path24.default.dirname(dir2);
+    for (const f of PROJECT_FILES) out.push(import_path26.default.join(dir2, f));
+    const parent = import_path26.default.dirname(dir2);
     if (parent === dir2) break;
     dir2 = parent;
   }
@@ -24203,7 +24385,7 @@ function configuredRegistryHosts(cwd, env = process.env, home = import_os16.defa
     const r = readCappedText(
       file2,
       MAX_CONFIG_BYTES,
-      import_fs23.default.constants.O_RDONLY | (import_fs23.default.constants.O_NONBLOCK ?? 0)
+      import_fs25.default.constants.O_RDONLY | (import_fs25.default.constants.O_NONBLOCK ?? 0)
     );
     if (r) hostsInText(r.text, hosts);
   }
@@ -24213,27 +24395,27 @@ function configuredRegistryHosts(cwd, env = process.env, home = import_os16.defa
 
 // src/utils/provenance.ts
 init_cjs_shims();
-var import_fs24 = __toESM(require("fs"));
-var import_path25 = __toESM(require("path"));
+var import_fs26 = __toESM(require("fs"));
+var import_path27 = __toESM(require("path"));
 var import_os17 = __toESM(require("os"));
 var SYSTEM_PREFIXES = ["/usr/bin", "/usr/sbin", "/bin", "/sbin"];
 var MANAGED_PREFIXES = ["/usr/local/bin", "/opt/homebrew", "/home/linuxbrew", "/nix/store"];
 var USER_PREFIXES = [
-  import_path25.default.join(import_os17.default.homedir(), "bin"),
-  import_path25.default.join(import_os17.default.homedir(), ".local", "bin"),
-  import_path25.default.join(import_os17.default.homedir(), ".cargo", "bin"),
-  import_path25.default.join(import_os17.default.homedir(), ".npm-global", "bin"),
-  import_path25.default.join(import_os17.default.homedir(), ".volta", "bin")
+  import_path27.default.join(import_os17.default.homedir(), "bin"),
+  import_path27.default.join(import_os17.default.homedir(), ".local", "bin"),
+  import_path27.default.join(import_os17.default.homedir(), ".cargo", "bin"),
+  import_path27.default.join(import_os17.default.homedir(), ".npm-global", "bin"),
+  import_path27.default.join(import_os17.default.homedir(), ".volta", "bin")
 ];
 var SUSPECT_PREFIXES = ["/tmp", "/var/tmp", "/dev/shm"];
 function findInPath(cmd) {
-  if (import_path25.default.posix.isAbsolute(cmd)) return cmd;
+  if (import_path27.default.posix.isAbsolute(cmd)) return cmd;
   const pathEnv = process.env.PATH ?? "";
-  for (const dir2 of pathEnv.split(import_path25.default.delimiter)) {
+  for (const dir2 of pathEnv.split(import_path27.default.delimiter)) {
     if (!dir2) continue;
-    const full = import_path25.default.join(dir2, cmd);
+    const full = import_path27.default.join(dir2, cmd);
     try {
-      import_fs24.default.accessSync(full, import_fs24.default.constants.X_OK);
+      import_fs26.default.accessSync(full, import_fs26.default.constants.X_OK);
       return full;
     } catch {
     }
@@ -24262,7 +24444,7 @@ function _classifyPath(resolved, cwd) {
 }
 function checkProvenance(cmd, cwd) {
   const bare = cmd.startsWith("./") ? cmd.slice(2) : cmd;
-  if (import_path25.default.posix.isAbsolute(bare)) {
+  if (import_path27.default.posix.isAbsolute(bare)) {
     const early = _classifyPath(bare, cwd);
     if (early.trustLevel === "suspect") {
       return { resolvedPath: bare, ...early };
@@ -24278,7 +24460,7 @@ function checkProvenance(cmd, cwd) {
         reason: "binary not found in PATH"
       };
     }
-    resolved = import_fs24.default.realpathSync(found);
+    resolved = import_fs26.default.realpathSync(found);
   } catch {
     return {
       resolvedPath: cmd,
@@ -24287,7 +24469,7 @@ function checkProvenance(cmd, cwd) {
     };
   }
   try {
-    const stat = import_fs24.default.statSync(resolved);
+    const stat = import_fs26.default.statSync(resolved);
     if (stat.mode & 2) {
       return {
         resolvedPath: resolved,
@@ -24341,9 +24523,9 @@ async function evaluatePolicy2(toolName, args, agent, cwd, opts) {
   );
 }
 function isGitWorkTreeTop(dir2, cwd) {
-  if (!import_path26.default.isAbsolute(cwd)) return true;
+  if (!import_path28.default.isAbsolute(cwd)) return true;
   try {
-    return import_fs25.default.existsSync(import_path26.default.join(import_path26.default.resolve(cwd, dir2), ".git"));
+    return import_fs27.default.existsSync(import_path28.default.join(import_path28.default.resolve(cwd, dir2), ".git"));
   } catch {
     return true;
   }
@@ -24353,7 +24535,7 @@ function readAgentSettings(absPath) {
   const r = readCappedText(
     absPath,
     MAX_AGENT_SETTINGS_BYTES,
-    import_fs25.default.constants.O_RDONLY | (import_fs25.default.constants.O_NONBLOCK ?? 0)
+    import_fs27.default.constants.O_RDONLY | (import_fs27.default.constants.O_NONBLOCK ?? 0)
   );
   return r && !r.truncated ? r.text : null;
 }
@@ -24363,12 +24545,12 @@ function isIgnoredTool2(toolName) {
 
 // src/auth/state.ts
 init_cjs_shims();
-var import_fs26 = __toESM(require("fs"));
-var import_path27 = __toESM(require("path"));
+var import_fs28 = __toESM(require("fs"));
+var import_path29 = __toESM(require("path"));
 var import_os18 = __toESM(require("os"));
 init_forecast_context();
-var PAUSED_FILE = import_path27.default.join(import_os18.default.homedir(), ".node9", "PAUSED");
-var TRUST_FILE = import_path27.default.join(import_os18.default.homedir(), ".node9", "trust.json");
+var PAUSED_FILE = import_path29.default.join(import_os18.default.homedir(), ".node9", "PAUSED");
+var TRUST_FILE = import_path29.default.join(import_os18.default.homedir(), ".node9", "trust.json");
 function extractCommandPattern(toolName, args) {
   const lower2 = toolName.toLowerCase();
   if (lower2 !== "bash" && lower2 !== "execute_bash" && lower2 !== "shell") return void 0;
@@ -24381,11 +24563,11 @@ function extractCommandPattern(toolName, args) {
 function checkPause() {
   if (forecastRun()) return { paused: false };
   try {
-    if (!import_fs26.default.existsSync(PAUSED_FILE)) return { paused: false };
-    const state = JSON.parse(import_fs26.default.readFileSync(PAUSED_FILE, "utf-8"));
+    if (!import_fs28.default.existsSync(PAUSED_FILE)) return { paused: false };
+    const state = JSON.parse(import_fs28.default.readFileSync(PAUSED_FILE, "utf-8"));
     if (state.expiry > 0 && Date.now() >= state.expiry) {
       try {
-        import_fs26.default.unlinkSync(PAUSED_FILE);
+        import_fs28.default.unlinkSync(PAUSED_FILE);
       } catch {
       }
       return { paused: false };
@@ -24398,8 +24580,8 @@ function checkPause() {
 function getActiveTrustSession(toolName, args) {
   if (forecastRun()) return false;
   try {
-    if (!import_fs26.default.existsSync(TRUST_FILE)) return false;
-    const trust = JSON.parse(import_fs26.default.readFileSync(TRUST_FILE, "utf-8"));
+    if (!import_fs28.default.existsSync(TRUST_FILE)) return false;
+    const trust = JSON.parse(import_fs28.default.readFileSync(TRUST_FILE, "utf-8"));
     const now = Date.now();
     const active = trust.entries.filter((e) => e.expiry > now);
     if (active.length !== trust.entries.length) {
@@ -24422,8 +24604,8 @@ function writeTrustSession(toolName, durationMs, args) {
   try {
     let trust = { entries: [] };
     try {
-      if (import_fs26.default.existsSync(TRUST_FILE)) {
-        trust = JSON.parse(import_fs26.default.readFileSync(TRUST_FILE, "utf-8"));
+      if (import_fs28.default.existsSync(TRUST_FILE)) {
+        trust = JSON.parse(import_fs28.default.readFileSync(TRUST_FILE, "utf-8"));
       }
     } catch {
     }
@@ -24445,9 +24627,9 @@ function writeTrustSession(toolName, durationMs, args) {
 }
 function getPersistentDecision(toolName) {
   try {
-    const file2 = import_path27.default.join(import_os18.default.homedir(), ".node9", "decisions.json");
-    if (!import_fs26.default.existsSync(file2)) return null;
-    const decisions = JSON.parse(import_fs26.default.readFileSync(file2, "utf-8"));
+    const file2 = import_path29.default.join(import_os18.default.homedir(), ".node9", "decisions.json");
+    if (!import_fs28.default.existsSync(file2)) return null;
+    const decisions = JSON.parse(import_fs28.default.readFileSync(file2, "utf-8"));
     const d = decisions[toolName];
     if (d === "allow" || d === "deny") return d;
   } catch {
@@ -24457,9 +24639,9 @@ function getPersistentDecision(toolName) {
 
 // src/auth/cloud.ts
 init_cjs_shims();
-var import_fs27 = __toESM(require("fs"));
+var import_fs29 = __toESM(require("fs"));
 var import_os19 = __toESM(require("os"));
-var import_path28 = __toESM(require("path"));
+var import_path30 = __toESM(require("path"));
 init_audit();
 init_dist();
 var CLOUD_ARRAY_KEYS = /* @__PURE__ */ new Set(["exposureDestinations", "exposureDestinationHashes"]);
@@ -24495,7 +24677,7 @@ async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPol
   let ciContext;
   if (process.env.CI) {
     try {
-      const ciContextPath = import_path28.default.join(import_os19.default.homedir(), ".node9", "ci-context.json");
+      const ciContextPath = import_path30.default.join(import_os19.default.homedir(), ".node9", "ci-context.json");
       const ci = readCappedText(ciContextPath, 1e4);
       if (!ci) throw new Error("ci-context.json unreadable");
       if (ci.truncated) throw new Error("ci-context.json exceeds 10 KB");
@@ -24613,14 +24795,14 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
     });
     clearTimeout(timer);
     if (!res.ok) {
-      import_fs27.default.appendFileSync(
+      import_fs29.default.appendFileSync(
         HOOK_DEBUG_LOG,
         `[resolve-cloud] PATCH ${safeMessage(resolveUrl, 200)} \u2192 HTTP ${res.status}
 `
       );
     }
   } catch (err) {
-    import_fs27.default.appendFileSync(
+    import_fs29.default.appendFileSync(
       HOOK_DEBUG_LOG,
       `[resolve-cloud] PATCH failed for ${safeMessage(requestId, 64)}: ${safeMessage(err)}
 `
@@ -24630,19 +24812,19 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
 
 // src/loop-detector.ts
 init_cjs_shims();
-var import_fs28 = __toESM(require("fs"));
-var import_path29 = __toESM(require("path"));
+var import_fs30 = __toESM(require("fs"));
+var import_path31 = __toESM(require("path"));
 var import_os20 = __toESM(require("os"));
 init_dist();
 init_forecast_context();
 init_dist();
 function loopStateFile() {
-  return import_path29.default.join(import_os20.default.homedir(), ".node9", "loop-state.json");
+  return import_path31.default.join(import_os20.default.homedir(), ".node9", "loop-state.json");
 }
 function readState() {
   try {
-    if (!import_fs28.default.existsSync(loopStateFile())) return [];
-    const raw = import_fs28.default.readFileSync(loopStateFile(), "utf-8");
+    if (!import_fs30.default.existsSync(loopStateFile())) return [];
+    const raw = import_fs30.default.readFileSync(loopStateFile(), "utf-8");
     const parsed = JSON.parse(raw);
     if (!Array.isArray(parsed)) return [];
     return parsed;
@@ -24651,11 +24833,11 @@ function readState() {
   }
 }
 function writeState(records) {
-  const dir2 = import_path29.default.dirname(loopStateFile());
-  if (!import_fs28.default.existsSync(dir2)) import_fs28.default.mkdirSync(dir2, { recursive: true });
+  const dir2 = import_path31.default.dirname(loopStateFile());
+  if (!import_fs30.default.existsSync(dir2)) import_fs30.default.mkdirSync(dir2, { recursive: true });
   const tmpPath = `${loopStateFile()}.${import_os20.default.hostname()}.${process.pid}.tmp`;
-  import_fs28.default.writeFileSync(tmpPath, JSON.stringify(records));
-  import_fs28.default.renameSync(tmpPath, loopStateFile());
+  import_fs30.default.writeFileSync(tmpPath, JSON.stringify(records));
+  import_fs30.default.renameSync(tmpPath, loopStateFile());
 }
 function recordAndCheck(tool, args, threshold = 3, windowMs = 12e4) {
   try {
@@ -25084,9 +25266,9 @@ function isMcpToolName(toolName) {
   return /^mcp__[^_](?:[^_]|_(?!_))*?__/i.test(toolName);
 }
 function absoluteUploadPath(spelled, cwd) {
-  const expanded = spelled === "~" || spelled.startsWith("~/") ? import_path30.default.join(import_os21.default.homedir(), spelled.slice(1)) : spelled;
-  if (import_path30.default.isAbsolute(expanded)) return expanded;
-  return cwd && import_path30.default.isAbsolute(cwd) ? import_path30.default.resolve(cwd, expanded) : expanded;
+  const expanded = spelled === "~" || spelled.startsWith("~/") ? import_path32.default.join(import_os21.default.homedir(), spelled.slice(1)) : spelled;
+  if (import_path32.default.isAbsolute(expanded)) return expanded;
+  return cwd && import_path32.default.isAbsolute(cwd) ? import_path32.default.resolve(cwd, expanded) : expanded;
 }
 function extractFilePaths(toolName, args, shellCommand) {
   const paths = [];
@@ -25632,7 +25814,9 @@ async function _authorizeHeadlessCore(toolName, args, metaArg, options) {
       systemAccessHandled: !isManual && fileAccess.handledPaths.has(filePath)
     }) : null) ?? argumentScan(),
     pii: () => detectArgsPii(args),
-    packageCheck: () => packageCheck?.enabled && !isManual ? runPackageCheck(toolName, args, packageCheck, options?.cwd, { offline: !!forecast }) : Promise.resolve(null)
+    packageCheck: () => packageCheck?.enabled && !isManual ? runPackageCheck(toolName, args, packageCheck, options?.cwd, {
+      offline: !!forecast && forecast.onlinePackages !== true
+    }) : Promise.resolve(null)
   });
   const dlpMatch = gates.stop?.dlpMatch ?? gates.reviews.dlp ?? null;
   if (dlpMatch) {
@@ -26481,29 +26665,29 @@ init_dist();
 
 // src/daemon/startup-log.ts
 init_cjs_shims();
-var import_fs29 = __toESM(require("fs"));
-var import_path31 = __toESM(require("path"));
+var import_fs31 = __toESM(require("fs"));
+var import_path33 = __toESM(require("path"));
 var import_os22 = __toESM(require("os"));
-var DAEMON_STARTUP_LOG = () => import_path31.default.join(import_os22.default.homedir(), ".node9", "daemon-startup.log");
+var DAEMON_STARTUP_LOG = () => import_path33.default.join(import_os22.default.homedir(), ".node9", "daemon-startup.log");
 var MAX_STARTUP_LOG_BYTES = 256 * 1024;
 function capStartupLog(file2) {
   try {
-    if (import_fs29.default.statSync(file2).size > MAX_STARTUP_LOG_BYTES) import_fs29.default.truncateSync(file2);
+    if (import_fs31.default.statSync(file2).size > MAX_STARTUP_LOG_BYTES) import_fs31.default.truncateSync(file2);
   } catch {
   }
 }
 function openStartupLogFd() {
   try {
     const file2 = DAEMON_STARTUP_LOG();
-    const dir2 = import_path31.default.dirname(file2);
-    if (!import_fs29.default.existsSync(dir2)) import_fs29.default.mkdirSync(dir2, { recursive: true });
+    const dir2 = import_path33.default.dirname(file2);
+    if (!import_fs31.default.existsSync(dir2)) import_fs31.default.mkdirSync(dir2, { recursive: true });
     capStartupLog(file2);
-    return import_fs29.default.openSync(file2, "a");
+    return import_fs31.default.openSync(file2, "a");
   } catch {
     return void 0;
   }
 }
-var DAEMON_STARTUP_STATE = () => import_path31.default.join(import_os22.default.homedir(), ".node9", "daemon-startup-state.json");
+var DAEMON_STARTUP_STATE = () => import_path33.default.join(import_os22.default.homedir(), ".node9", "daemon-startup-state.json");
 var MAX_DETAIL = 200;
 var STARTING_GRACE_MS = 90 * 1e3;
 function recordStartupState(outcome, kind, detail) {
@@ -26517,18 +26701,18 @@ function recordStartupState(outcome, kind, detail) {
       }
     }
     const file2 = DAEMON_STARTUP_STATE();
-    const dir2 = import_path31.default.dirname(file2);
-    if (!import_fs29.default.existsSync(dir2)) import_fs29.default.mkdirSync(dir2, { recursive: true });
+    const dir2 = import_path33.default.dirname(file2);
+    if (!import_fs31.default.existsSync(dir2)) import_fs31.default.mkdirSync(dir2, { recursive: true });
     const state = { outcome, at: (/* @__PURE__ */ new Date()).toISOString() };
     if (kind) state.kind = kind;
     if (detail) state.detail = detail.slice(0, MAX_DETAIL);
     const tmp = `${file2}.${process.pid}.tmp`;
     try {
-      import_fs29.default.writeFileSync(tmp, JSON.stringify(state), "utf-8");
-      import_fs29.default.renameSync(tmp, file2);
+      import_fs31.default.writeFileSync(tmp, JSON.stringify(state), "utf-8");
+      import_fs31.default.renameSync(tmp, file2);
     } catch (err) {
       try {
-        import_fs29.default.unlinkSync(tmp);
+        import_fs31.default.unlinkSync(tmp);
       } catch {
       }
       throw err;
@@ -26538,7 +26722,7 @@ function recordStartupState(outcome, kind, detail) {
 }
 function readStartupState() {
   try {
-    const raw = import_fs29.default.readFileSync(DAEMON_STARTUP_STATE(), "utf-8");
+    const raw = import_fs31.default.readFileSync(DAEMON_STARTUP_STATE(), "utf-8");
     const s = JSON.parse(raw);
     if (!s || typeof s.outcome !== "string" || typeof s.at !== "string") return null;
     return s;
@@ -26550,26 +26734,26 @@ function readStartupState() {
 // src/cli/daemon-starter.ts
 init_cjs_shims();
 var import_child_process2 = require("child_process");
-var import_path32 = __toESM(require("path"));
-var import_fs30 = __toESM(require("fs"));
+var import_path34 = __toESM(require("path"));
+var import_fs32 = __toESM(require("fs"));
 var import_os23 = __toESM(require("os"));
 function isTestingMode() {
   return /^(1|true|yes)$/i.test(process.env.NODE9_TESTING ?? "");
 }
-var SKIP_STAMP = () => import_path32.default.join(import_os23.default.homedir(), ".node9", ".autostart-skip-stamp");
+var SKIP_STAMP = () => import_path34.default.join(import_os23.default.homedir(), ".node9", ".autostart-skip-stamp");
 var SKIP_THROTTLE_MS = 60 * 60 * 1e3;
 function logAutostartSkipThrottled(reason) {
   try {
     const stamp = SKIP_STAMP();
     try {
-      if (Date.now() - import_fs30.default.statSync(stamp).mtimeMs < SKIP_THROTTLE_MS) return;
+      if (Date.now() - import_fs32.default.statSync(stamp).mtimeMs < SKIP_THROTTLE_MS) return;
     } catch {
     }
-    const dir2 = import_path32.default.join(import_os23.default.homedir(), ".node9");
-    if (!import_fs30.default.existsSync(dir2)) import_fs30.default.mkdirSync(dir2, { recursive: true });
-    import_fs30.default.writeFileSync(stamp, "", "utf-8");
-    import_fs30.default.appendFileSync(
-      import_path32.default.join(dir2, "hook-debug.log"),
+    const dir2 = import_path34.default.join(import_os23.default.homedir(), ".node9");
+    if (!import_fs32.default.existsSync(dir2)) import_fs32.default.mkdirSync(dir2, { recursive: true });
+    import_fs32.default.writeFileSync(stamp, "", "utf-8");
+    import_fs32.default.appendFileSync(
+      import_path34.default.join(dir2, "hook-debug.log"),
       `[${(/* @__PURE__ */ new Date()).toISOString()}] daemon-autostart-skip: ${reason}
 `,
       "utf-8"
@@ -26588,10 +26772,10 @@ async function autoStartDaemonAndWait() {
     return true;
   }
   if (isTestingMode()) return false;
-  if (!import_path32.default.isAbsolute(process.argv[1])) return false;
+  if (!import_path34.default.isAbsolute(process.argv[1])) return false;
   let resolvedArgv1;
   try {
-    resolvedArgv1 = import_fs30.default.realpathSync(process.argv[1]);
+    resolvedArgv1 = import_fs32.default.realpathSync(process.argv[1]);
   } catch {
     return false;
   }
@@ -26629,7 +26813,7 @@ async function autoStartDaemonAndWait() {
   } finally {
     if (startupFd !== void 0) {
       try {
-        import_fs30.default.closeSync(startupFd);
+        import_fs32.default.closeSync(startupFd);
       } catch {
       }
     }
@@ -26639,12 +26823,12 @@ async function autoStartDaemonAndWait() {
 
 // src/skill-pin.ts
 init_cjs_shims();
-var import_fs31 = __toESM(require("fs"));
-var import_path33 = __toESM(require("path"));
+var import_fs33 = __toESM(require("fs"));
+var import_path35 = __toESM(require("path"));
 var import_os24 = __toESM(require("os"));
 var import_crypto11 = __toESM(require("crypto"));
-function getPinsFilePath() {
-  return import_path33.default.join(import_os24.default.homedir(), ".node9", "skill-pins.json");
+function getPinsFilePath(home = import_os24.default.homedir()) {
+  return import_path35.default.join(home, ".node9", "skill-pins.json");
 }
 var MAX_FILES = 5e3;
 var MAX_TOTAL_BYTES = 50 * 1024 * 1024;
@@ -26658,18 +26842,18 @@ function walkDir(root) {
     if (out.length >= MAX_FILES) return;
     let entries;
     try {
-      entries = import_fs31.default.readdirSync(dir2, { withFileTypes: true });
+      entries = import_fs33.default.readdirSync(dir2, { withFileTypes: true });
     } catch {
       return;
     }
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       if (out.length >= MAX_FILES) return;
-      const full = import_path33.default.join(dir2, entry.name);
-      const rel = relDir ? import_path33.default.posix.join(relDir, entry.name) : entry.name;
+      const full = import_path35.default.join(dir2, entry.name);
+      const rel = relDir ? import_path35.default.posix.join(relDir, entry.name) : entry.name;
       let lst;
       try {
-        lst = import_fs31.default.lstatSync(full);
+        lst = import_fs33.default.lstatSync(full);
       } catch {
         continue;
       }
@@ -26694,14 +26878,14 @@ function walkDir(root) {
 function hashSkillRoot(absPath) {
   let lst;
   try {
-    lst = import_fs31.default.lstatSync(absPath);
+    lst = import_fs33.default.lstatSync(absPath);
   } catch {
     return { exists: false, contentHash: "", fileCount: 0 };
   }
   if (lst.isSymbolicLink()) return { exists: false, contentHash: "", fileCount: 0 };
   if (lst.isFile()) {
     try {
-      return { exists: true, contentHash: sha256Bytes(import_fs31.default.readFileSync(absPath)), fileCount: 1 };
+      return { exists: true, contentHash: sha256Bytes(import_fs33.default.readFileSync(absPath)), fileCount: 1 };
     } catch {
       return { exists: false, contentHash: "", fileCount: 0 };
     }
@@ -26716,10 +26900,10 @@ function hashSkillRoot(absPath) {
 function getRootKey(absPath) {
   return import_crypto11.default.createHash("sha256").update(absPath).digest("hex").slice(0, 16);
 }
-function readSkillPinsSafe() {
-  const filePath = getPinsFilePath();
+function readSkillPinsSafe(home) {
+  const filePath = getPinsFilePath(home);
   try {
-    const raw = import_fs31.default.readFileSync(filePath, "utf-8");
+    const raw = import_fs33.default.readFileSync(filePath, "utf-8");
     if (!raw.trim()) return { ok: false, reason: "corrupt", detail: "empty file" };
     const parsed = JSON.parse(raw);
     if (!parsed.roots || typeof parsed.roots !== "object" || Array.isArray(parsed.roots)) {
@@ -26733,10 +26917,10 @@ function readSkillPinsSafe() {
 }
 function writeSkillPins(data) {
   const filePath = getPinsFilePath();
-  import_fs31.default.mkdirSync(import_path33.default.dirname(filePath), { recursive: true });
+  import_fs33.default.mkdirSync(import_path35.default.dirname(filePath), { recursive: true });
   const tmp = `${filePath}.${import_crypto11.default.randomBytes(6).toString("hex")}.tmp`;
-  import_fs31.default.writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 384 });
-  import_fs31.default.renameSync(tmp, filePath);
+  import_fs33.default.writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 384 });
+  import_fs33.default.renameSync(tmp, filePath);
 }
 function verifyAndPinRoots(roots) {
   const pinsRead = readSkillPinsSafe();
@@ -26771,37 +26955,37 @@ function verifyAndPinRoots(roots) {
   if (mutated) writeSkillPins(pins);
   return { kind: "verified" };
 }
-function defaultSkillRoots(_cwd) {
-  const marketplaces = import_path33.default.join(import_os24.default.homedir(), ".claude", "plugins", "marketplaces");
+function defaultSkillRoots(_cwd, home = import_os24.default.homedir()) {
+  const marketplaces = import_path35.default.join(home, ".claude", "plugins", "marketplaces");
   const roots = [];
   let registries;
   try {
-    registries = import_fs31.default.readdirSync(marketplaces, { withFileTypes: true });
+    registries = import_fs33.default.readdirSync(marketplaces, { withFileTypes: true });
   } catch {
     return [];
   }
   for (const registry of registries) {
     if (!registry.isDirectory()) continue;
-    const pluginsDir = import_path33.default.join(marketplaces, registry.name, "plugins");
+    const pluginsDir = import_path35.default.join(marketplaces, registry.name, "plugins");
     let plugins;
     try {
-      plugins = import_fs31.default.readdirSync(pluginsDir, { withFileTypes: true });
+      plugins = import_fs33.default.readdirSync(pluginsDir, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const plugin of plugins) {
       if (!plugin.isDirectory()) continue;
-      roots.push(import_path33.default.join(pluginsDir, plugin.name));
+      roots.push(import_path35.default.join(pluginsDir, plugin.name));
     }
   }
   return roots;
 }
 function resolveUserSkillRoot(entry, cwd) {
   if (!entry) return null;
-  if (entry.startsWith("~/") || entry === "~") return import_path33.default.join(import_os24.default.homedir(), entry.slice(1));
-  if (import_path33.default.isAbsolute(entry)) return entry;
-  if (!cwd || !import_path33.default.isAbsolute(cwd)) return null;
-  return import_path33.default.join(cwd, entry);
+  if (entry.startsWith("~/") || entry === "~") return import_path35.default.join(import_os24.default.homedir(), entry.slice(1));
+  if (import_path35.default.isAbsolute(entry)) return entry;
+  if (!cwd || !import_path35.default.isAbsolute(cwd)) return null;
+  return import_path35.default.join(cwd, entry);
 }
 
 // src/cli/commands/check.ts
@@ -26820,12 +27004,12 @@ function isKeyedForPolicy() {
 
 // src/review-pending.ts
 init_cjs_shims();
-var import_fs32 = __toESM(require("fs"));
+var import_fs34 = __toESM(require("fs"));
 var import_os25 = __toESM(require("os"));
-var import_path34 = __toESM(require("path"));
+var import_path36 = __toESM(require("path"));
 init_hasher();
 function storePath() {
-  return process.env.NODE9_PENDING_STORE || import_path34.default.join(import_os25.default.homedir(), ".node9", "pending-reviews.json");
+  return process.env.NODE9_PENDING_STORE || import_path36.default.join(import_os25.default.homedir(), ".node9", "pending-reviews.json");
 }
 var TTL_TUID_MS = 72 * 60 * 60 * 1e3;
 var TTL_MS2 = 6 * 60 * 60 * 1e3;
@@ -26843,7 +27027,7 @@ function reviewCorrelationKey(payload) {
 }
 function read2() {
   try {
-    const parsed = JSON.parse(import_fs32.default.readFileSync(storePath(), "utf-8"));
+    const parsed = JSON.parse(import_fs34.default.readFileSync(storePath(), "utf-8"));
     if (parsed && Array.isArray(parsed.entries)) return parsed;
   } catch {
   }
@@ -26852,11 +27036,11 @@ function read2() {
 function write(store) {
   try {
     const p = storePath();
-    const dir2 = import_path34.default.dirname(p);
-    if (!import_fs32.default.existsSync(dir2)) import_fs32.default.mkdirSync(dir2, { recursive: true });
+    const dir2 = import_path36.default.dirname(p);
+    if (!import_fs34.default.existsSync(dir2)) import_fs34.default.mkdirSync(dir2, { recursive: true });
     const tmp = `${p}.${process.pid}.tmp`;
-    import_fs32.default.writeFileSync(tmp, JSON.stringify(store));
-    import_fs32.default.renameSync(tmp, p);
+    import_fs34.default.writeFileSync(tmp, JSON.stringify(store));
+    import_fs34.default.renameSync(tmp, p);
   } catch {
   }
 }
@@ -26954,53 +27138,11 @@ function canonicalToolInput(rawToolName, input) {
   return canonical;
 }
 
-// src/utils/own-dir.ts
-init_cjs_shims();
-var import_fs33 = __toESM(require("fs"));
-var import_path35 = __toESM(require("path"));
-var SESSION_FLAG_SUFFIX = ".node9-flag";
-var SESSION_FLAG_NAME = /^[A-Za-z0-9_-]{1,128}\.node9-flag$/;
-function isSessionFlagName(name) {
-  return SESSION_FLAG_NAME.test(name);
-}
-function ownRealDir(st) {
-  if (st.isSymbolicLink() || !st.isDirectory()) return false;
-  return typeof process.getuid !== "function" || st.uid === process.getuid();
-}
-function ensureOwnDir(dir2) {
-  try {
-    import_fs33.default.mkdirSync(dir2, { recursive: true, mode: 448 });
-    const st = import_fs33.default.lstatSync(dir2);
-    return ownRealDir(st) ? { dev: st.dev, ino: st.ino } : null;
-  } catch {
-    return null;
-  }
-}
-function isSameOwnDir(dir2, seen) {
-  try {
-    const st = import_fs33.default.lstatSync(dir2);
-    return ownRealDir(st) && st.dev === seen.dev && st.ino === seen.ino;
-  } catch {
-    return false;
-  }
-}
-function removeOldFlag(dir2, seen, name, cutoffMs) {
-  if (!isSessionFlagName(name)) return;
-  const p = import_path35.default.join(dir2, name);
-  try {
-    const st = import_fs33.default.lstatSync(p);
-    if (!st.isFile() || st.mtimeMs >= cutoffMs) return;
-    if (!isSameOwnDir(dir2, seen)) return;
-    import_fs33.default.unlinkSync(p);
-  } catch {
-  }
-}
-
 // src/notices/session-notice.ts
 init_cjs_shims();
-var import_fs34 = __toESM(require("fs"));
+var import_fs35 = __toESM(require("fs"));
 var import_os26 = __toESM(require("os"));
-var import_path36 = __toESM(require("path"));
+var import_path37 = __toESM(require("path"));
 init_dist();
 var ICON = "\u{1F6E1}\uFE0F";
 var LEVEL_NAMES = {
@@ -27042,24 +27184,24 @@ function sessionNoticeEnabled(env = process.env) {
 var FLAG_MAX_BYTES = 32;
 function claimSessionNotice(sessionId, home = import_os26.default.homedir(), level = "standard") {
   if (!sessionId || !SAFE_SESSION_ID.test(sessionId)) return null;
-  const dir2 = import_path36.default.join(home, ".node9", "notice-sessions");
+  const dir2 = import_path37.default.join(home, ".node9", "notice-sessions");
   const seen = ensureOwnDir(dir2);
   if (!seen) return null;
-  const flag = import_path36.default.join(dir2, sessionId + SESSION_FLAG_SUFFIX);
+  const flag = import_path37.default.join(dir2, sessionId + SESSION_FLAG_SUFFIX);
   let created = false;
   try {
     if (!isSameOwnDir(dir2, seen)) return null;
-    const fd = import_fs34.default.openSync(flag, "wx", 384);
+    const fd = import_fs35.default.openSync(flag, "wx", 384);
     created = true;
     try {
-      import_fs34.default.writeSync(fd, level);
+      import_fs35.default.writeSync(fd, level);
     } finally {
-      import_fs34.default.closeSync(fd);
+      import_fs35.default.closeSync(fd);
     }
   } catch (err) {
     if (created) {
       try {
-        import_fs34.default.unlinkSync(flag);
+        import_fs35.default.unlinkSync(flag);
       } catch {
       }
       return null;
@@ -27083,22 +27225,22 @@ function levelChange(dir2, seen, flag, level) {
   }
 }
 function readFlag(flag) {
-  const c = import_fs34.default.constants;
-  const fd = import_fs34.default.openSync(flag, c.O_RDONLY | (c.O_NOFOLLOW ?? 0) | (c.O_NONBLOCK ?? 0));
+  const c = import_fs35.default.constants;
+  const fd = import_fs35.default.openSync(flag, c.O_RDONLY | (c.O_NOFOLLOW ?? 0) | (c.O_NONBLOCK ?? 0));
   try {
-    const st = import_fs34.default.fstatSync(fd);
+    const st = import_fs35.default.fstatSync(fd);
     if (!st.isFile() || st.nlink !== 1 || st.size > FLAG_MAX_BYTES) return null;
     const buf = Buffer.alloc(FLAG_MAX_BYTES);
-    const n = import_fs34.default.readSync(fd, buf, 0, FLAG_MAX_BYTES, 0);
+    const n = import_fs35.default.readSync(fd, buf, 0, FLAG_MAX_BYTES, 0);
     return buf.toString("utf8", 0, n).trim();
   } finally {
-    import_fs34.default.closeSync(fd);
+    import_fs35.default.closeSync(fd);
   }
 }
 function removeOldFlags(dir2, seen) {
   const cutoff = Date.now() - FLAG_TTL_MS;
   try {
-    for (const name of import_fs34.default.readdirSync(dir2)) removeOldFlag(dir2, seen, name, cutoff);
+    for (const name of import_fs35.default.readdirSync(dir2)) removeOldFlag(dir2, seen, name, cutoff);
   } catch {
   }
 }
@@ -27181,9 +27323,9 @@ function registerCheckCommand(program2) {
         } catch (err) {
           const tempConfig = getConfig();
           if (process.env.NODE9_DEBUG === "1" || tempConfig.settings.enableHookLogDebug) {
-            const logPath = import_path37.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
+            const logPath = import_path38.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
             const errMsg = err instanceof Error ? err.message : String(err);
-            import_fs35.default.appendFileSync(
+            import_fs36.default.appendFileSync(
               logPath,
               `[${(/* @__PURE__ */ new Date()).toISOString()}] JSON_PARSE_ERROR: ${errMsg}
 RAW: ${raw}
@@ -27196,14 +27338,14 @@ RAW: ${raw}
           const prompt = typeof payload.prompt === "string" ? payload.prompt : "";
           if (process.env.NODE9_DEBUG === "1") {
             try {
-              const logPath = import_path37.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
-              if (!import_fs35.default.existsSync(import_path37.default.dirname(logPath)))
-                import_fs35.default.mkdirSync(import_path37.default.dirname(logPath), { recursive: true });
+              const logPath = import_path38.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
+              if (!import_fs36.default.existsSync(import_path38.default.dirname(logPath)))
+                import_fs36.default.mkdirSync(import_path38.default.dirname(logPath), { recursive: true });
               const sanitized = JSON.stringify({
                 ...payload,
                 prompt: `<redacted, ${prompt.length} bytes>`
               });
-              import_fs35.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${sanitized}
+              import_fs36.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${sanitized}
 `);
             } catch {
             }
@@ -27221,7 +27363,7 @@ RAW: ${raw}
           if (!dlpMatch && !canaryHit) {
             try {
               const sid = typeof payload.session_id === "string" ? payload.session_id : typeof payload.conversationId === "string" ? payload.conversationId : "";
-              const promptCwd = typeof payload.cwd === "string" && import_path37.default.isAbsolute(payload.cwd) ? payload.cwd : void 0;
+              const promptCwd = typeof payload.cwd === "string" && import_path38.default.isAbsolute(payload.cwd) ? payload.cwd : void 0;
               if (sid && getConfig(promptCwd).policy.untrustedContent?.enabled) {
                 await notifyUserMentions(sid, extractContentDestinations(prompt));
               }
@@ -27262,8 +27404,8 @@ RAW: ${raw}
           );
           const reason = `\u{1F6A8} Node9 DLP: ${shownPattern} detected in prompt (${shownSample}). Prompt was not submitted \u2014 remove the credential and try again.`;
           try {
-            const ttyFd = import_fs35.default.openSync("/dev/tty", "w");
-            import_fs35.default.writeSync(
+            const ttyFd = import_fs36.default.openSync("/dev/tty", "w");
+            import_fs36.default.writeSync(
               ttyFd,
               import_chalk2.default.bgRed.white.bold(`
  \u{1F6A8} NODE9 DLP \u2014 PROMPT BLOCKED 
@@ -27273,7 +27415,7 @@ RAW: ${raw}
 
 `)
             );
-            import_fs35.default.closeSync(ttyFd);
+            import_fs36.default.closeSync(ttyFd);
           } catch {
           }
           const isCodex = agent2 === "Codex";
@@ -27292,17 +27434,17 @@ RAW: ${raw}
           process.exit(2);
         }
         const payloadCwd = typeof payload.cwd === "string" ? payload.cwd : Array.isArray(payload.workspacePaths) && typeof payload.workspacePaths[0] === "string" ? payload.workspacePaths[0] : void 0;
-        const safeCwdForConfig = typeof payloadCwd === "string" && import_path37.default.isAbsolute(payloadCwd) ? payloadCwd : void 0;
+        const safeCwdForConfig = typeof payloadCwd === "string" && import_path38.default.isAbsolute(payloadCwd) ? payloadCwd : void 0;
         const config = getConfig(safeCwdForConfig);
         const daemonDown = !isDaemonRunning();
         if (config.settings.autoStartDaemon && daemonDown && !process.env.NODE9_NO_AUTO_DAEMON) {
           try {
             const scriptPath = process.argv[1];
-            if (typeof scriptPath !== "string" || !import_path37.default.isAbsolute(scriptPath))
+            if (typeof scriptPath !== "string" || !import_path38.default.isAbsolute(scriptPath))
               throw new Error("node9: argv[1] is not an absolute path");
-            const resolvedScript = import_fs35.default.realpathSync(scriptPath);
-            const packageDist = import_fs35.default.realpathSync(import_path37.default.resolve(__dirname, "../.."));
-            if (!resolvedScript.startsWith(packageDist + import_path37.default.sep) && resolvedScript !== packageDist)
+            const resolvedScript = import_fs36.default.realpathSync(scriptPath);
+            const packageDist = import_fs36.default.realpathSync(import_path38.default.resolve(__dirname, "../.."));
+            if (!resolvedScript.startsWith(packageDist + import_path38.default.sep) && resolvedScript !== packageDist)
               throw new Error(
                 `node9: daemon spawn aborted \u2014 argv[1] (${resolvedScript}) is outside package dist (${packageDist})`
               );
@@ -27332,17 +27474,17 @@ RAW: ${raw}
             } finally {
               if (startupFd !== void 0) {
                 try {
-                  import_fs35.default.closeSync(startupFd);
+                  import_fs36.default.closeSync(startupFd);
                 } catch {
                 }
               }
             }
           } catch (spawnErr) {
-            const logPath = import_path37.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
+            const logPath = import_path38.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
             const msg = spawnErr instanceof Error ? spawnErr.message : String(spawnErr);
             recordStartupState("failed", "spawn-aborted", msg);
             try {
-              import_fs35.default.appendFileSync(
+              import_fs36.default.appendFileSync(
                 logPath,
                 `[${(/* @__PURE__ */ new Date()).toISOString()}] daemon-autostart-failed: ${msg}
 `
@@ -27356,10 +27498,10 @@ RAW: ${raw}
           );
         }
         if (process.env.NODE9_DEBUG === "1" || config.settings.enableHookLogDebug) {
-          const logPath = import_path37.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
-          if (!import_fs35.default.existsSync(import_path37.default.dirname(logPath)))
-            import_fs35.default.mkdirSync(import_path37.default.dirname(logPath), { recursive: true });
-          import_fs35.default.appendFileSync(
+          const logPath = import_path38.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
+          if (!import_fs36.default.existsSync(import_path38.default.dirname(logPath)))
+            import_fs36.default.mkdirSync(import_path38.default.dirname(logPath), { recursive: true });
+          import_fs36.default.appendFileSync(
             logPath,
             `[${(/* @__PURE__ */ new Date()).toISOString()}] STDIN: ${JSON.stringify(raw)}
 `
@@ -27380,8 +27522,8 @@ RAW: ${raw}
           );
           let ttyFd = null;
           try {
-            ttyFd = import_fs35.default.openSync("/dev/tty", "w");
-            const writeTty = (line) => import_fs35.default.writeSync(ttyFd, line + "\n");
+            ttyFd = import_fs36.default.openSync("/dev/tty", "w");
+            const writeTty = (line) => import_fs36.default.writeSync(ttyFd, line + "\n");
             if (result2?.blockKind === "protected-path") {
               writeTty(
                 import_chalk2.default.red.bold(
@@ -27408,7 +27550,7 @@ RAW: ${raw}
           } finally {
             if (ttyFd !== null)
               try {
-                import_fs35.default.closeSync(ttyFd);
+                import_fs36.default.closeSync(ttyFd);
               } catch {
               }
           }
@@ -27479,8 +27621,8 @@ RAW: ${raw}
           } catch {
           }
           try {
-            const ttyFd = import_fs35.default.openSync("/dev/tty", "w");
-            import_fs35.default.writeSync(
+            const ttyFd = import_fs36.default.openSync("/dev/tty", "w");
+            import_fs36.default.writeSync(
               ttyFd,
               import_chalk2.default.yellow(
                 `
@@ -27488,7 +27630,7 @@ RAW: ${raw}
 `
               )
             );
-            import_fs35.default.closeSync(ttyFd);
+            import_fs36.default.closeSync(ttyFd);
           } catch {
           }
           if (agent === "GitHub Copilot") {
@@ -27520,14 +27662,14 @@ RAW: ${raw}
         const safeSessionId = /^[A-Za-z0-9_\-]{1,128}$/.test(rawSessionId) ? rawSessionId : "";
         if (skillPinCfg.enabled && safeSessionId) {
           try {
-            const sessionsDir = import_path37.default.join(import_os27.default.homedir(), ".node9", "skill-sessions");
-            const flagPath = import_path37.default.join(sessionsDir, `${safeSessionId}${SESSION_FLAG_SUFFIX}`);
+            const sessionsDir = import_path38.default.join(import_os27.default.homedir(), ".node9", "skill-sessions");
+            const flagPath = import_path38.default.join(sessionsDir, `${safeSessionId}${SESSION_FLAG_SUFFIX}`);
             const memo = ensureOwnDir(sessionsDir);
             let flag = null;
             try {
-              const st = memo ? import_fs35.default.lstatSync(flagPath) : null;
+              const st = memo ? import_fs36.default.lstatSync(flagPath) : null;
               if (st && st.isFile() && st.nlink === 1)
-                flag = JSON.parse(import_fs35.default.readFileSync(flagPath, "utf-8"));
+                flag = JSON.parse(import_fs36.default.readFileSync(flagPath, "utf-8"));
             } catch {
             }
             const writeFlag = (data2) => {
@@ -27544,8 +27686,8 @@ RAW: ${raw}
             const sendSkillWarn = (detail, recoveryCmd) => {
               let ttyFd = null;
               try {
-                ttyFd = import_fs35.default.openSync("/dev/tty", "w");
-                const w = (line) => import_fs35.default.writeSync(ttyFd, line + "\n");
+                ttyFd = import_fs36.default.openSync("/dev/tty", "w");
+                const w = (line) => import_fs36.default.writeSync(ttyFd, line + "\n");
                 w(import_chalk2.default.yellow(`
 \u26A0\uFE0F  Node9: installed skill drift detected`));
                 w(import_chalk2.default.gray(`   ${detail}`));
@@ -27560,7 +27702,7 @@ RAW: ${raw}
               } finally {
                 if (ttyFd !== null)
                   try {
-                    import_fs35.default.closeSync(ttyFd);
+                    import_fs36.default.closeSync(ttyFd);
                   } catch {
                   }
               }
@@ -27576,7 +27718,7 @@ RAW: ${raw}
               return;
             }
             if (!flag || flag.state !== "verified" && flag.state !== "warned") {
-              const absoluteCwd = typeof payloadCwd === "string" && import_path37.default.isAbsolute(payloadCwd) ? payloadCwd : void 0;
+              const absoluteCwd = typeof payloadCwd === "string" && import_path38.default.isAbsolute(payloadCwd) ? payloadCwd : void 0;
               const extraRoots = skillPinCfg.roots;
               const resolvedExtra = extraRoots.map((r) => resolveUserSkillRoot(r, absoluteCwd)).filter((r) => typeof r === "string");
               const roots = [...defaultSkillRoots(absoluteCwd), ...resolvedExtra];
@@ -27618,7 +27760,7 @@ RAW: ${raw}
               if (memo)
                 try {
                   const cutoff = Date.now() - 7 * 24 * 60 * 60 * 1e3;
-                  for (const name of import_fs35.default.readdirSync(sessionsDir))
+                  for (const name of import_fs36.default.readdirSync(sessionsDir))
                     removeOldFlag(sessionsDir, memo, name, cutoff);
                 } catch {
                 }
@@ -27626,16 +27768,16 @@ RAW: ${raw}
           } catch (err) {
             if (process.env.NODE9_DEBUG === "1") {
               try {
-                const dbg = import_path37.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
+                const dbg = import_path38.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
                 const msg = err instanceof Error ? err.message : String(err);
-                import_fs35.default.appendFileSync(dbg, `[${(/* @__PURE__ */ new Date()).toISOString()}] SKILL_PIN_ERROR: ${msg}
+                import_fs36.default.appendFileSync(dbg, `[${(/* @__PURE__ */ new Date()).toISOString()}] SKILL_PIN_ERROR: ${msg}
 `);
               } catch {
               }
             }
           }
         }
-        const safeCwdForAuth = typeof payloadCwd === "string" && import_path37.default.isAbsolute(payloadCwd) ? payloadCwd : void 0;
+        const safeCwdForAuth = typeof payloadCwd === "string" && import_path38.default.isAbsolute(payloadCwd) ? payloadCwd : void 0;
         const askMode = resolveAskMode(agent, opts, config);
         const result = await authorizeHeadless(toolName, toolInput, meta, {
           cwd: safeCwdForAuth,
@@ -27653,7 +27795,7 @@ RAW: ${raw}
           const notice = checkedBy !== "paused" && agent === "Claude Code" && !isSubagentCall && sessionNoticeEnabled() ? claimSessionNotice(safeSessionId, import_os27.default.homedir(), levelOf(config.settings.mode)) : null;
           if (notice) {
             try {
-              import_fs35.default.writeSync(1, sessionNoticeOutput(config.settings.mode, notice) + "\n");
+              import_fs36.default.writeSync(1, sessionNoticeOutput(config.settings.mode, notice) + "\n");
             } catch {
             }
           }
@@ -27671,12 +27813,12 @@ RAW: ${raw}
         }
         if (result.noApprovalMechanism && !isDaemonRunning() && !process.env.NODE9_NO_AUTO_DAEMON && !process.stdout.isTTY && config.settings.autoStartDaemon) {
           try {
-            const tty = import_fs35.default.openSync("/dev/tty", "w");
-            import_fs35.default.writeSync(
+            const tty = import_fs36.default.openSync("/dev/tty", "w");
+            import_fs36.default.writeSync(
               tty,
               import_chalk2.default.cyan("\n\u{1F6E1}\uFE0F  Node9: Starting approval daemon automatically...\n")
             );
-            import_fs35.default.closeSync(tty);
+            import_fs36.default.closeSync(tty);
           } catch {
           }
           const daemonReady = await autoStartDaemonAndWait();
@@ -27703,9 +27845,9 @@ RAW: ${raw}
         });
       } catch (err) {
         if (process.env.NODE9_DEBUG === "1") {
-          const logPath = import_path37.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
+          const logPath = import_path38.default.join(import_os27.default.homedir(), ".node9", "hook-debug.log");
           const errMsg = err instanceof Error ? err.message : String(err);
-          import_fs35.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] ERROR: ${errMsg}
+          import_fs36.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] ERROR: ${errMsg}
 `);
         }
         process.exit(0);
@@ -27740,12 +27882,21 @@ RAW: ${raw}
 
 // src/cli/commands/log.ts
 init_cjs_shims();
-var import_fs36 = __toESM(require("fs"));
-var import_path38 = __toESM(require("path"));
+var import_fs37 = __toESM(require("fs"));
+var import_path39 = __toESM(require("path"));
 var import_os28 = __toESM(require("os"));
 init_audit();
 init_dist();
 
+// src/exposure/shell-fetch.ts
+init_cjs_shims();
+init_dist();
+function shellFetch(tool, rawInput) {
+  if (tool !== "Bash" && tool !== "bash") return null;
+  const cmd = rawInput && typeof rawInput === "object" && !Array.isArray(rawInput) ? rawInput.command : void 0;
+  return typeof cmd === "string" && cmd.length > 0 ? classifyShellExposure(cmd) : null;
+}
+
 // src/exposure/source.ts
 init_cjs_shims();
 init_audit();
@@ -27959,11 +28110,6 @@ function buildArgsField(rawInput) {
     return hashed;
   }
 }
-function shellFetch(tool, rawInput) {
-  if (tool !== "Bash" && tool !== "bash") return null;
-  const cmd = rawInput && typeof rawInput === "object" && !Array.isArray(rawInput) ? rawInput.command : void 0;
-  return typeof cmd === "string" && cmd.length > 0 ? classifyShellExposure(cmd) : null;
-}
 function registerLogCommand(program2) {
   program2.command("log", { hidden: true }).description("PostToolUse hook \u2014 records executed tool calls").argument("[data]", "JSON string of the tool call").option(
     "--agent <name>",
@@ -28010,12 +28156,12 @@ function registerLogCommand(program2) {
         if (rawToolName !== tool) entry.agentToolName = rawToolName;
         const payloadSessionId = payload.session_id ?? payload.conversationId;
         if (payloadSessionId) entry.sessionId = payloadSessionId;
-        const logPath = import_path38.default.join(import_os28.default.homedir(), ".node9", "audit.log");
-        if (!import_fs36.default.existsSync(import_path38.default.dirname(logPath)))
-          import_fs36.default.mkdirSync(import_path38.default.dirname(logPath), { recursive: true });
-        import_fs36.default.appendFileSync(logPath, JSON.stringify(entry) + "\n");
+        const logPath = import_path39.default.join(import_os28.default.homedir(), ".node9", "audit.log");
+        if (!import_fs37.default.existsSync(import_path39.default.dirname(logPath)))
+          import_fs37.default.mkdirSync(import_path39.default.dirname(logPath), { recursive: true });
+        import_fs37.default.appendFileSync(logPath, JSON.stringify(entry) + "\n");
         const payloadCwd = typeof payload.cwd === "string" ? payload.cwd : Array.isArray(payload.workspacePaths) && typeof payload.workspacePaths[0] === "string" ? payload.workspacePaths[0] : void 0;
-        const safeCwd = typeof payloadCwd === "string" && import_path38.default.isAbsolute(payloadCwd) ? payloadCwd : void 0;
+        const safeCwd = typeof payloadCwd === "string" && import_path39.default.isAbsolute(payloadCwd) ? payloadCwd : void 0;
         if ((tool === "Bash" || tool === "bash") && isDaemonRunning()) {
           const command = typeof rawInput === "object" && rawInput !== null && "command" in rawInput && typeof rawInput.command === "string" ? rawInput.command : null;
           if (command) {
@@ -28236,9 +28382,9 @@ function registerLogCommand(program2) {
         const msg = err instanceof Error ? err.message : String(err);
         process.stderr.write(`[Node9] audit log error: ${msg}
 `);
-        const debugPath = import_path38.default.join(import_os28.default.homedir(), ".node9", "hook-debug.log");
+        const debugPath = import_path39.default.join(import_os28.default.homedir(), ".node9", "hook-debug.log");
         try {
-          import_fs36.default.appendFileSync(debugPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] LOG_ERROR: ${msg}
+          import_fs37.default.appendFileSync(debugPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] LOG_ERROR: ${msg}
 `);
         } catch {
         }
@@ -28261,9 +28407,9 @@ function registerLogCommand(program2) {
   });
 }
 function absolutePathFor(spelled, cwd) {
-  const expanded = spelled === "~" || spelled.startsWith("~/") ? import_path38.default.join(import_os28.default.homedir(), spelled.slice(1)) : spelled;
-  if (import_path38.default.isAbsolute(expanded)) return expanded;
-  return cwd ? import_path38.default.resolve(cwd, expanded) : import_path38.default.resolve(expanded);
+  const expanded = spelled === "~" || spelled.startsWith("~/") ? import_path39.default.join(import_os28.default.homedir(), spelled.slice(1)) : spelled;
+  if (import_path39.default.isAbsolute(expanded)) return expanded;
+  return cwd ? import_path39.default.resolve(cwd, expanded) : import_path39.default.resolve(expanded);
 }
 async function carryTaintAcrossWrites(command, cwd) {
   let pairs;
@@ -28282,13 +28428,13 @@ async function carryTaintAcrossWrites(command, cwd) {
       continue;
     }
     const sensitive = scanFilePath(src, cwd);
-    if (sensitive) await notifyTaint(dst, `copy:${sensitive.patternName}:${import_path38.default.basename(src)}`);
+    if (sensitive) await notifyTaint(dst, `copy:${sensitive.patternName}:${import_path39.default.basename(src)}`);
   }
 }
 
 // src/hook-entry.ts
 var { version } = JSON.parse(
-  import_fs37.default.readFileSync(import_path39.default.join(__dirname, "../package.json"), "utf-8")
+  import_fs38.default.readFileSync(import_path40.default.join(__dirname, "../package.json"), "utf-8")
 );
 var program = new import_commander.Command();
 program.name("node9").description("The Sudo Command for AI Agents").version(version);
@@ -28297,9 +28443,9 @@ registerLogCommand(program);
 process.on("unhandledRejection", (reason) => {
   if (process.argv[2] === "check") {
     if (process.env.NODE9_DEBUG === "1" || getConfig().settings.enableHookLogDebug) {
-      const logPath = import_path39.default.join(import_os29.default.homedir(), ".node9", "hook-debug.log");
+      const logPath = import_path40.default.join(import_os29.default.homedir(), ".node9", "hook-debug.log");
       const msg = reason instanceof Error ? reason.message : String(reason);
-      import_fs37.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] UNHANDLED: ${msg}
+      import_fs38.default.appendFileSync(logPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] UNHANDLED: ${msg}
 `);
     }
     process.exit(0);